An update for qemu is now available for openEuler-24.03-LTS-SP4 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2026-3845 Final 1.0 1.0 2026-09-14 Initial 2026-09-14 2026-09-14 openEuler SA Tool V1.0 2026-09-14 qemu security update An update for qemu is now available for openEuler-24.03-LTS-SP4 QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fix(es): An unknown vulnerability exists in QEMU, with no detailed description available at this time.(CVE-2026-15264) CVE-2026-16457 is a security vulnerability in QEMU. The specific details of this vulnerability have not been fully disclosed. This vulnerability may affect the normal operation of the QEMU virtualization platform and poses potential security risks.(CVE-2026-16457) CVE-2026-18054 is a vulnerability in QEMU, details are not yet disclosed.(CVE-2026-18054) This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4(CVE-2026-3890) This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4. This vulnerability (CVE-2026-48004) is one of them.(CVE-2026-48004) QEMU's virtio-rng frontend does not cancel or detach an RngRequest that is still pending on the rng-random backend before releasing the VirtIORNG object in virtio_rng_device_unrealize(). When a virtio-rng device is hot-plugged (device_del) and there are still entropy requests pending, the delayed backend completion calls the chr_read callback on the released object, causing the host heap to be use-after-free. An attacker able to trigger hot-plugging of the device could exploit this memory security flaw to compromise the QEMU process, causing a denial of service or potential code execution on the host.(CVE-2026-50624) An unknown vulnerability exists in QEMU, details are not yet disclosed.(CVE-2026-50626) No detailed vulnerability information available.(CVE-2026-61402) An unspecified vulnerability exists in QEMU, with no detailed information available at this time.(CVE-2026-61476) CVE-2026-63109 is a vulnerability in QEMU. Details of this vulnerability have not been publicly disclosed yet.(CVE-2026-63109) No detailed description available.(CVE-2026-63110) An unknown vulnerability exists in QEMU, the details of which have not yet been disclosed. Attackers may exploit this vulnerability to cause unknown impacts.(CVE-2026-63320) An unknown vulnerability exists in QEMU, the details of which have not yet been disclosed. Attackers may exploit this vulnerability to cause unknown impacts.(CVE-2026-63321) When QEMU's uefi-vars-x64 virtual device processes the VarCheckPolicy REGISTER command, the uefi_vars_mm_check_policy_register() function directly reads pe->size without first verifying whether the request length contains the complete variable_policy_entry header. The guest can send a REGISTER request with a length of exactly sizeof(mm_check_policy) (excluding variable_policy_entry), causing the func pointer to cross the end of the allocated MM communication buffer, causing the host heap buffer to read out of bounds (heap-buffer-overflow). An attacker could exploit this memory security flaw to compromise the QEMU process, causing a denial of service or potential code execution on the host.(CVE-2026-63322) An undisclosed vulnerability exists in QEMU, the details of which are not yet publicly available.(CVE-2026-63323) An unknown type vulnerability exists in QEMU (Quick Emulator). The specific details have not been disclosed yet.(CVE-2026-65928) CVE-2026-65929 is a security vulnerability affecting QEMU, with no detailed technical information disclosed yet.(CVE-2026-65929) QEMU (Quick Emulator) is an open-source machine emulator and virtualizer widely used to run operating systems for different architectures. CVE-2026-66021 is a security vulnerability affecting QEMU, with specific details not yet fully disclosed.(CVE-2026-66021) An unspecified vulnerability exists in QEMU, the details of which have not been disclosed.(CVE-2026-66022) QEMU's VNC extended clipboard handler, after decompressing a client-controlled clipboard payload, compares the declared text size to the entire decompression buffer size, but then copies tsize bytes from buf + 4. The correct boundary is the remaining data length after the 4-byte length field. Therefore, a VNC client can cause QEMU to read up to 3 bytes out of bounds from the end of the decompressed heap buffer; a second VNC client can observe these bytes through the normal VNC extended clipboard PROVIDE path.(CVE-2026-8343) An update for qemu is now available for master/openEuler-20.03-LTS-SP4/openEuler-24.03-LTS-SP4. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High qemu https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-15264 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-16457 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-18054 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-3890 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-48004 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-50624 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-50626 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-61402 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-61476 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-63109 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-63110 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-63320 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-63321 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-63322 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-63323 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-65928 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-65929 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-66021 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-66022 https://www.openeuler.org/en/security/cve/detail/?cveId=CVE-2026-8343 https://nvd.nist.gov/vuln/detail/CVE-2026-15264 https://nvd.nist.gov/vuln/detail/CVE-2026-16457 https://nvd.nist.gov/vuln/detail/CVE-2026-18054 https://nvd.nist.gov/vuln/detail/CVE-2026-3890 https://nvd.nist.gov/vuln/detail/CVE-2026-48004 https://nvd.nist.gov/vuln/detail/CVE-2026-50624 https://nvd.nist.gov/vuln/detail/CVE-2026-50626 https://nvd.nist.gov/vuln/detail/CVE-2026-61402 https://nvd.nist.gov/vuln/detail/CVE-2026-61476 https://nvd.nist.gov/vuln/detail/CVE-2026-63109 https://nvd.nist.gov/vuln/detail/CVE-2026-63110 https://nvd.nist.gov/vuln/detail/CVE-2026-63320 https://nvd.nist.gov/vuln/detail/CVE-2026-63321 https://nvd.nist.gov/vuln/detail/CVE-2026-63322 https://nvd.nist.gov/vuln/detail/CVE-2026-63323 https://nvd.nist.gov/vuln/detail/CVE-2026-65928 https://nvd.nist.gov/vuln/detail/CVE-2026-65929 https://nvd.nist.gov/vuln/detail/CVE-2026-66021 https://nvd.nist.gov/vuln/detail/CVE-2026-66022 https://nvd.nist.gov/vuln/detail/CVE-2026-8343 openEuler-24.03-LTS-SP4 qemu-8.2.0-86.oe2403sp4.aarch64.rpm qemu-block-curl-8.2.0-86.oe2403sp4.aarch64.rpm qemu-block-iscsi-8.2.0-86.oe2403sp4.aarch64.rpm qemu-block-rbd-8.2.0-86.oe2403sp4.aarch64.rpm qemu-block-ssh-8.2.0-86.oe2403sp4.aarch64.rpm qemu-debuginfo-8.2.0-86.oe2403sp4.aarch64.rpm qemu-debugsource-8.2.0-86.oe2403sp4.aarch64.rpm qemu-guest-agent-8.2.0-86.oe2403sp4.aarch64.rpm qemu-hw-usb-host-8.2.0-86.oe2403sp4.aarch64.rpm qemu-img-8.2.0-86.oe2403sp4.aarch64.rpm qemu-system-aarch64-8.2.0-86.oe2403sp4.aarch64.rpm qemu-system-arm-8.2.0-86.oe2403sp4.aarch64.rpm qemu-system-riscv-8.2.0-86.oe2403sp4.aarch64.rpm qemu-system-x86_64-8.2.0-86.oe2403sp4.aarch64.rpm qemu-user-8.2.0-86.oe2403sp4.aarch64.rpm qemu-user-binfmt-8.2.0-86.oe2403sp4.aarch64.rpm qemu-user-static-8.2.0-86.oe2403sp4.aarch64.rpm qemu-8.2.0-86.oe2403sp4.src.rpm qemu-8.2.0-86.oe2403sp4.x86_64.rpm qemu-block-curl-8.2.0-86.oe2403sp4.x86_64.rpm qemu-block-iscsi-8.2.0-86.oe2403sp4.x86_64.rpm qemu-block-rbd-8.2.0-86.oe2403sp4.x86_64.rpm qemu-block-ssh-8.2.0-86.oe2403sp4.x86_64.rpm qemu-debuginfo-8.2.0-86.oe2403sp4.x86_64.rpm qemu-debugsource-8.2.0-86.oe2403sp4.x86_64.rpm qemu-guest-agent-8.2.0-86.oe2403sp4.x86_64.rpm qemu-hw-usb-host-8.2.0-86.oe2403sp4.x86_64.rpm qemu-img-8.2.0-86.oe2403sp4.x86_64.rpm qemu-seabios-8.2.0-86.oe2403sp4.x86_64.rpm qemu-system-aarch64-8.2.0-86.oe2403sp4.x86_64.rpm qemu-system-arm-8.2.0-86.oe2403sp4.x86_64.rpm qemu-system-riscv-8.2.0-86.oe2403sp4.x86_64.rpm qemu-system-x86_64-8.2.0-86.oe2403sp4.x86_64.rpm qemu-user-8.2.0-86.oe2403sp4.x86_64.rpm qemu-user-binfmt-8.2.0-86.oe2403sp4.x86_64.rpm qemu-user-static-8.2.0-86.oe2403sp4.x86_64.rpm qemu-help-8.2.0-86.oe2403sp4.noarch.rpm An unknown vulnerability exists in QEMU, with no detailed description available at this time. 2026-09-14 CVE-2026-15264 openEuler-24.03-LTS-SP4 High 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 CVE-2026-16457 is a security vulnerability in QEMU. The specific details of this vulnerability have not been fully disclosed. This vulnerability may affect the normal operation of the QEMU virtualization platform and poses potential security risks. 2026-09-14 CVE-2026-16457 openEuler-24.03-LTS-SP4 Medium 6.5 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 CVE-2026-18054 is a vulnerability in QEMU, details are not yet disclosed. 2026-09-14 CVE-2026-18054 openEuler-24.03-LTS-SP4 Low 3.8 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4 2026-09-14 CVE-2026-3890 openEuler-24.03-LTS-SP4 Medium 6.5 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 This update to qemu-10.2.4-2.mga10 fixes 14 CVEs from 10.2.3 and 2 from 10.2.4. This vulnerability (CVE-2026-48004) is one of them. 2026-09-14 CVE-2026-48004 openEuler-24.03-LTS-SP4 Medium 4.7 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 QEMU's virtio-rng frontend does not cancel or detach an RngRequest that is still pending on the rng-random backend before releasing the VirtIORNG object in virtio_rng_device_unrealize(). When a virtio-rng device is hot-plugged (device_del) and there are still entropy requests pending, the delayed backend completion calls the chr_read callback on the released object, causing the host heap to be use-after-free. An attacker able to trigger hot-plugging of the device could exploit this memory security flaw to compromise the QEMU process, causing a denial of service or potential code execution on the host. 2026-09-14 CVE-2026-50624 openEuler-24.03-LTS-SP4 Medium 4.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 An unknown vulnerability exists in QEMU, details are not yet disclosed. 2026-09-14 CVE-2026-50626 openEuler-24.03-LTS-SP4 High 8.8 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 No detailed vulnerability information available. 2026-09-14 CVE-2026-61402 openEuler-24.03-LTS-SP4 High 7.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 An unspecified vulnerability exists in QEMU, with no detailed information available at this time. 2026-09-14 CVE-2026-61476 openEuler-24.03-LTS-SP4 Medium 6.5 AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 CVE-2026-63109 is a vulnerability in QEMU. Details of this vulnerability have not been publicly disclosed yet. 2026-09-14 CVE-2026-63109 openEuler-24.03-LTS-SP4 Low 3.8 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 No detailed description available. 2026-09-14 CVE-2026-63110 openEuler-24.03-LTS-SP4 Low 3.4 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 An unknown vulnerability exists in QEMU, the details of which have not yet been disclosed. Attackers may exploit this vulnerability to cause unknown impacts. 2026-09-14 CVE-2026-63320 openEuler-24.03-LTS-SP4 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 An unknown vulnerability exists in QEMU, the details of which have not yet been disclosed. Attackers may exploit this vulnerability to cause unknown impacts. 2026-09-14 CVE-2026-63321 openEuler-24.03-LTS-SP4 Medium 5.2 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 When QEMU's uefi-vars-x64 virtual device processes the VarCheckPolicy REGISTER command, the uefi_vars_mm_check_policy_register() function directly reads pe->size without first verifying whether the request length contains the complete variable_policy_entry header. The guest can send a REGISTER request with a length of exactly sizeof(mm_check_policy) (excluding variable_policy_entry), causing the func pointer to cross the end of the allocated MM communication buffer, causing the host heap buffer to read out of bounds (heap-buffer-overflow). An attacker could exploit this memory security flaw to compromise the QEMU process, causing a denial of service or potential code execution on the host. 2026-09-14 CVE-2026-63322 openEuler-24.03-LTS-SP4 Medium 4.4 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 An undisclosed vulnerability exists in QEMU, the details of which are not yet publicly available. 2026-09-14 CVE-2026-63323 openEuler-24.03-LTS-SP4 High 7.0 AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 An unknown type vulnerability exists in QEMU (Quick Emulator). The specific details have not been disclosed yet. 2026-09-14 CVE-2026-65928 openEuler-24.03-LTS-SP4 Medium 4.4 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 CVE-2026-65929 is a security vulnerability affecting QEMU, with no detailed technical information disclosed yet. 2026-09-14 CVE-2026-65929 openEuler-24.03-LTS-SP4 Medium 5.5 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 QEMU (Quick Emulator) is an open-source machine emulator and virtualizer widely used to run operating systems for different architectures. CVE-2026-66021 is a security vulnerability affecting QEMU, with specific details not yet fully disclosed. 2026-09-14 CVE-2026-66021 openEuler-24.03-LTS-SP4 High 7.3 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 An unspecified vulnerability exists in QEMU, the details of which have not been disclosed. 2026-09-14 CVE-2026-66022 openEuler-24.03-LTS-SP4 High 7.8 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845 QEMU's VNC extended clipboard handler, after decompressing a client-controlled clipboard payload, compares the declared text size to the entire decompression buffer size, but then copies tsize bytes from buf + 4. The correct boundary is the remaining data length after the 4-byte length field. Therefore, a VNC client can cause QEMU to read up to 3 bytes out of bounds from the end of the decompressed heap buffer; a second VNC client can observe these bytes through the normal VNC extended clipboard PROVIDE path. 2026-09-14 CVE-2026-8343 openEuler-24.03-LTS-SP4 Medium 5.3 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N qemu security update 2026-09-14 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3845