An update for qemu is now available for openEuler-24.03-LTS-SP3 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-2861 Final 1.0 1.0 2026-07-06 Initial 2026-07-06 2026-07-06 openEuler SA Tool V1.0 2026-07-06 qemu security update An update for qemu is now available for openEuler-24.03-LTS-SP3 QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fix(es): A vulnerability, which was classified as critical, has been found in QEMU (Virtualization Software) (version unknown).Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.Impacted is confidentiality, integrity, and availability.Upgrading eliminates this vulnerability.(CVE-2026-3886) A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process.(CVE-2026-48914) An update for qemu is now available for master/openEuler-24.03-LTS-SP3. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High qemu https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2861 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-3886 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-48914 https://nvd.nist.gov/vuln/detail/CVE-2026-3886 https://nvd.nist.gov/vuln/detail/CVE-2026-48914 openEuler-24.03-LTS-SP3 qemu-8.2.0-80.oe2403sp3.aarch64.rpm qemu-block-curl-8.2.0-80.oe2403sp3.aarch64.rpm qemu-block-iscsi-8.2.0-80.oe2403sp3.aarch64.rpm qemu-block-rbd-8.2.0-80.oe2403sp3.aarch64.rpm qemu-block-ssh-8.2.0-80.oe2403sp3.aarch64.rpm qemu-debuginfo-8.2.0-80.oe2403sp3.aarch64.rpm qemu-debugsource-8.2.0-80.oe2403sp3.aarch64.rpm qemu-guest-agent-8.2.0-80.oe2403sp3.aarch64.rpm qemu-hw-usb-host-8.2.0-80.oe2403sp3.aarch64.rpm qemu-img-8.2.0-80.oe2403sp3.aarch64.rpm qemu-system-aarch64-8.2.0-80.oe2403sp3.aarch64.rpm qemu-system-arm-8.2.0-80.oe2403sp3.aarch64.rpm qemu-system-riscv-8.2.0-80.oe2403sp3.aarch64.rpm qemu-system-x86_64-8.2.0-80.oe2403sp3.aarch64.rpm qemu-user-8.2.0-80.oe2403sp3.aarch64.rpm qemu-user-binfmt-8.2.0-80.oe2403sp3.aarch64.rpm qemu-user-static-8.2.0-80.oe2403sp3.aarch64.rpm qemu-8.2.0-80.oe2403sp3.src.rpm qemu-8.2.0-80.oe2403sp3.x86_64.rpm qemu-block-curl-8.2.0-80.oe2403sp3.x86_64.rpm qemu-block-iscsi-8.2.0-80.oe2403sp3.x86_64.rpm qemu-block-rbd-8.2.0-80.oe2403sp3.x86_64.rpm qemu-block-ssh-8.2.0-80.oe2403sp3.x86_64.rpm qemu-debuginfo-8.2.0-80.oe2403sp3.x86_64.rpm qemu-debugsource-8.2.0-80.oe2403sp3.x86_64.rpm qemu-guest-agent-8.2.0-80.oe2403sp3.x86_64.rpm qemu-hw-usb-host-8.2.0-80.oe2403sp3.x86_64.rpm qemu-img-8.2.0-80.oe2403sp3.x86_64.rpm qemu-seabios-8.2.0-80.oe2403sp3.x86_64.rpm qemu-system-aarch64-8.2.0-80.oe2403sp3.x86_64.rpm qemu-system-arm-8.2.0-80.oe2403sp3.x86_64.rpm qemu-system-riscv-8.2.0-80.oe2403sp3.x86_64.rpm qemu-system-x86_64-8.2.0-80.oe2403sp3.x86_64.rpm qemu-user-8.2.0-80.oe2403sp3.x86_64.rpm qemu-user-binfmt-8.2.0-80.oe2403sp3.x86_64.rpm qemu-user-static-8.2.0-80.oe2403sp3.x86_64.rpm qemu-help-8.2.0-80.oe2403sp3.noarch.rpm A vulnerability, which was classified as critical, has been found in QEMU (Virtualization Software) (version unknown).Using CWE to declare the problem leads to CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.Impacted is confidentiality, integrity, and availability.Upgrading eliminates this vulnerability. 2026-07-06 CVE-2026-3886 openEuler-24.03-LTS-SP3 High 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H qemu security update 2026-07-06 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2861 A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors before writing data. A malicious guest with high privileges could exploit this vulnerability by submitting a malformed virtio-blk SCSI request, leading to an out-of-bounds write in the host heap memory and a potential denial of service (DoS) for the QEMU process. 2026-07-06 CVE-2026-48914 openEuler-24.03-LTS-SP3 Medium 6.7 AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H qemu security update 2026-07-06 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2861