Description

A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can result in a crash of the QEMU process or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel, combined with a destination configured to use vhost inflight migration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-10T22:17:10.027Z",
  "pubdate": "2026-08-10T22:17:10.027Z",
  "executiveSummary": "A type mismatch vulnerability exists in QEMU's handling of vhost inflight migration VMState data.\nThe vulnerability allows an attacker with control over the migration producer or write access to the migration channel to cause memory corruption or a denial-of-service condition.\nThe flaw affects QEMU deployments configured to use vhost inflight migration.\nRisk implications include potential arbitrary memory corruption and QEMU process crashes, potentially impacting virtual machine availability and hypervisor stability.\nExploitation requires the attacker to possess write access to the migration channel or control over the migration producer, alongside a destination VM configured with vhost inflight migration capabilities.",
  "technicalDetails": "The root cause of the vulnerability is a type mismatch during VMState handling for vhost inflight migration data within QEMU.\nThe destination buffer size is natively stored as a uint64_t data type but is subsequently read by the VMS_VBUFFER load path as a signed int32_t type.\nOn little-endian hosts, supplying a crafted incoming migration state with bit 31 set forces the value to be interpreted as a negative integer.\nUpon being treated as negative, this value undergoes an implicit conversion to a very large size_t value.\nThis excessively large size is then passed directly to the qemu_get_buffer() function, triggering a memory copy operation that writes migration-stream data beyond the authorized boundaries of the mmap-backed inflight region.\nThe vulnerable component is the VMState loading mechanism processing vhost inflight migration buffers via qemu_get_buffer().\nStep-by-step, exploitation occurs as follows: first, an attacker crafts a malicious migration stream where the buffer size field has bit 31 set; second, the migration stream is transmitted to the target QEMU instance; third, the destination QEMU parses the VMState and misinterprets the uint64_t size as a signed int32_t; fourth, the signed value is implicitly cast to an oversized size_t; fifth, qemu_get_buffer() performs an out-of-bounds heap or memory copy based on the inflated size.\nThe resulting post-exploitation impact includes out-of-bounds memory corruption or an immediate crash of the QEMU process due to invalid memory access."
}