CVE-2026-3195

As of 2026-06-19, CVE-2026-3195 is a CVSS 7.4 (HIGH-severity) vulnerability. Threadlinqs Intelligence tracks 0 threats exploiting it.

Last updated: 2026-06-19

A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pcm_in_cb` function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730.

CVSS v3 vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-122

References

• https://access.redhat.com/security/cve/CVE-2026-3195
• https://bugzilla.redhat.com/show_bug.cgi?id=2443817

← all vulnerabilities · Markdown version · Threadlinqs Intelligence

Enriched from CVE.org, NVD (this product uses the NVD API but is not endorsed or certified by the NVD), FIRST EPSS, CISA KEV, and GitHub Security Advisories.