CVE-2025-11234
published 2025-10-03CVE-2025-11234: A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.78%
51.9th percentile
A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | qemu | < qemu 1:7.2+dfsg-7+deb12u18 (bookworm) | qemu 1:7.2+dfsg-7+deb12u18 (bookworm) |
| msrc | azl3_php_8.3.12-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_php_8.3.14-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_qemu_8.2.0-19_on_azure_linux_3.0 | — | — |
| msrc | azl3_qemu_8.2.0-21_on_azure_linux_3.0 | — | — |
| msrc | azl3_qemu_8.2.0-23_on_azure_linux_3.0 | — | — |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl2_php_8.1.30-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_php_8.1.31-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_qemu_6.2.0-24_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_qemu_6.2.0-25_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| qemu | qemu | >= 0 < 1:7.2+dfsg-7+deb12u18 | 1:7.2+dfsg-7+deb12u18 |
| qemu | qemu | >= 0 < 1:10.0.7+ds-0+deb13u1 | 1:10.0.7+ds-0+deb13u1 |
| qemu | qemu | >= 0 < 1:10.1.3+ds-1 | 1:10.1.3+ds-1 |
| qemu | qemu | >= 0 < 1:6.2+dfsg-2ubuntu6.28 | 1:6.2+dfsg-2ubuntu6.28 |
| qemu | qemu | >= 0 < 1:8.2.2+ds-0ubuntu1.13 | 1:8.2.2+ds-0ubuntu1.13 |
| qemu | qemu | >= 0 < 1:10.1.0+ds-5ubuntu2.4 | 1:10.1.0+ds-5ubuntu2.4 |
| ubuntu | qemu | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
QEMU regression
vendor_ubuntu·2026-06-28·CVSS 3.8
CVE-2020-11947 [LOW] QEMU regression
Title: QEMU regression
Summary: USN-8412-1 introduced a regression in QEMU
USN-8412-1 fixed vulnerabilities QEMU. On Ubuntu 20.04 LTS, the fix for
CVE-2024-4467 was incomplete and prevented the creation of boot volumes
from qcow2 images. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Felipe Franciosi, Raphael Norwitz, and Peter Turschmid discovered that the
iSCSI block driver in QEMU incorrectly handled certain responses from an
iSCSI server. A remote attacker could possibly use this issue to cause
QEMU to crash, resulting in a denial of service, or possibly execute
arbitrary code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-1711)
It was discovered that the iSCSI block driver in QEMU incorrectly handled
certain memory operations
Ubuntu
QEMU vulnerabilities
vendor_ubuntu·2026-06-09·CVSS 3.8
CVE-2021-3416 [LOW] QEMU vulnerabilities
Title: QEMU vulnerabilities
Summary: Several security issues were fixed in QEMU.
Felipe Franciosi, Raphael Norwitz, and Peter Turschmid discovered that the
iSCSI block driver in QEMU incorrectly handled certain responses from an
iSCSI server. A remote attacker could possibly use this issue to cause QEMU
to crash, resulting in a denial of service, or possibly execute arbitrary
code. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-1711)
It was discovered that the iSCSI block driver in QEMU incorrectly handled
certain memory operations, leading to a heap-based buffer over-read. An
attacker could possibly use this issue to expose sensitive information from
the host. This issue only affected Ubuntu 14.04 LTS. (CVE-2020-11947)
Ziming Zhang discovered that the SM501 display driver in QEM
Ubuntu
QEMU vulnerabilities
vendor_ubuntu·2026-03-04·CVSS 5.5
CVE-2026-0665 [MEDIUM] QEMU vulnerabilities
Title: QEMU vulnerabilities
Summary: Several security issues were fixed in QEMU.
It was discovered that the UHCI controller implementation of QEMU could be
brought into an invalid state. An attacker inside the guest could possibly
use this issue to cause QEMU to crash, resulting in a denial of service.
(CVE-2024-8354)
It was discovered that QEMU incorrectly handled memory during certain VNC
operations. An remote attacker could possibly use this issue to cause QEMU
to crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2025-11234)
It was discovered that the e1000 network device implementation of QEMU
could be made to write out of bounds. An attacker inside the guest could
possibly use this issue to cause QEMU to crash, resulting in a denial of
service, or p
Microsoft
Qemu-kvm: vnc websocket handshake use-after-free
vendor_msrc·2025-10-14·CVSS 7.5
CVE-2025-11234 [HIGH] CWE-416 Qemu-kvm: vnc websocket handshake use-after-free
Qemu-kvm: vnc websocket handshake use-after-free
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
redhat: redhat
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.micr
Red Hat
qemu-kvm: VNC WebSocket handshake use-after-free
vendor_redhat·2025-09-30·CVSS 7.5
CVE-2025-11234 [HIGH] CWE-416 qemu-kvm: VNC WebSocket handshake use-after-free
qemu-kvm: VNC WebSocket handshake use-after-free
A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.
A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port
Debian
CVE-2025-11234: qemu - A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is w...
vendor_debian·2025·CVSS 7.5
CVE-2025-11234 [HIGH] CVE-2025-11234: qemu - A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is w...
A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.
Scope: local
bookworm: resolved (fixed in 1:7.2+dfsg-7+deb12u18)
bullseye: open
forky: resolved (fixed in 1:10.1.3+ds-1)
sid: resolved (fixed in 1:10.1.3+ds-1)
trixie: resolved (fixed in 1:10.0.7+ds-0+deb13u1)
Microsoft
Configuring a proxy in a stream context might allow for CRLF injection in URIs
vendor_msrc·2024-11-12·CVSS 7.2
CVE-2024-11234 [MEDIUM] CWE-20 Configuring a proxy in a stream context might allow for CRLF injection in URIs
Configuring a proxy in a stream context might allow for CRLF injection in URIs
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
php: php
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Refer
OSV
qemu vulnerabilities
osv·2026-03-04·CVSS 5.5
CVE-2024-8354 [MEDIUM] qemu vulnerabilities
qemu vulnerabilities
It was discovered that the UHCI controller implementation of QEMU could be
brought into an invalid state. An attacker inside the guest could possibly
use this issue to cause QEMU to crash, resulting in a denial of service.
(CVE-2024-8354)
It was discovered that QEMU incorrectly handled memory during certain VNC
operations. An remote attacker could possibly use this issue to cause QEMU
to crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2025-11234)
It was discovered that the e1000 network device implementation of QEMU
could be made to write out of bounds. An attacker inside the guest could
possibly use this issue to cause QEMU to crash, resulting in a denial of
service, or possibly execute arbitrary code. This issue only affected
Ubun
GHSA
GHSA-hm8v-8c3v-cxfq: A flaw was found in QEMU
ghsa_unreviewed·2025-10-03
CVE-2025-11234 [HIGH] CWE-416 GHSA-hm8v-8c3v-cxfq: A flaw was found in QEMU
A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.
OSV
CVE-2025-11234: A flaw was found in QEMU
osv·2025-10-03·CVSS 7.5
CVE-2025-11234 [HIGH] CVE-2025-11234: A flaw was found in QEMU
A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws
blogs_bleepingcomputer·2025-10-14·CVSS 7.8
[HIGH] Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws
## Microsoft October 2025 Patch Tuesday fixes 6 zero-days, 172 flaws
## Lawrence Abrams
80 Elevation of Privilege Vulnerabilities
11 Security Feature Bypass Vulnerabilities
31 Remote Code Execution Vulnerabilities
28 Information Disclosure Vulnerabilities
11 Denial of Service Vulnerabilities
10 Spoofing Vulnerabilities
When BleepingComputer reports on the Patch Tuesday security updates, we only count those released today by Microsoft. Therefore, the number of flaws does not include those fixed in Azure, Mariner, Microsoft Edge, and other vulnerabilities earlier this month.
Notably, Windows 10 reaches the end of support today , with this being the last Patch Tuesday where Microsoft provides free security updates to the venerable operating system.
To continue receiving security upd
Bugzilla
CVE-2025-11234 qemu: VNC WebSocket handshake use-after-free [fedora-42]
bugzilla·2025-10-03·CVSS 7.5
CVE-2025-11234 [HIGH] CVE-2025-11234 qemu: VNC WebSocket handshake use-after-free [fedora-42]
CVE-2025-11234 qemu: VNC WebSocket handshake use-after-free [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug reports from rel
Bugzilla
CVE-2025-11234 qemu-kvm: VNC WebSocket handshake use-after-free
bugzilla·2025-10-03·CVSS 7.5
CVE-2025-11234 [HIGH] CVE-2025-11234 qemu-kvm: VNC WebSocket handshake use-after-free
CVE-2025-11234 qemu-kvm: VNC WebSocket handshake use-after-free
If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This flaw can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.
Reported-by:
Grant Millar | Cylo
Upstream patch:
https://lists.nongnu.org/archive/html/qemu-devel/2025-10/msg00786.html
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9.4 Extended Update Support
Via RHSA-2025:23228 https://access.redhat.com/errata/RHSA-2025:23228
---
This iss
Bugzilla
CVE-2024-11234 php: Configuring a proxy in a stream context might allow for CRLF injection in URIs
bugzilla·2024-11-24·CVSS 7.2
CVE-2024-11234 [HIGH] CVE-2024-11234 php: Configuring a proxy in a stream context might allow for CRLF injection in URIs
CVE-2024-11234 php: Configuring a proxy in a stream context might allow for CRLF injection in URIs
In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, when using streams with configured proxy and "request_fulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests originating from the server, thus potentially gaining access to resources not normally available to the external user.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:4263 https://access.redhat.com/errata/RHSA-2025:4263
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9
Via RHSA-2025:7315 htt
https://access.redhat.com/errata/RHSA-2025:23228https://access.redhat.com/errata/RHSA-2026:0326https://access.redhat.com/errata/RHSA-2026:0332https://access.redhat.com/errata/RHSA-2026:0702https://access.redhat.com/errata/RHSA-2026:1831https://access.redhat.com/errata/RHSA-2026:18772https://access.redhat.com/errata/RHSA-2026:22147https://access.redhat.com/errata/RHSA-2026:3077https://access.redhat.com/errata/RHSA-2026:3165https://access.redhat.com/errata/RHSA-2026:5578https://access.redhat.com/security/cve/CVE-2025-11234https://bugzilla.redhat.com/show_bug.cgi?id=2401209
2025-10-03
Published