CVE-2026-3196
published 2026-06-19CVE-2026-3196: An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious guest can provide out-of-bounds stream…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.14%
3.6th percentile
An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | qemu | < qemu 1:10.2.2+ds-1 (forky) | qemu 1:10.2.2+ds-1 (forky) |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_ubuntu8.2HIGH
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest.
ghsa_unreviewed·2026-06-19
CVE-2026-3196 [MEDIUM] CWE-190 An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest.
An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition.
VulDB
QEMU integer overflow
vuldb·2026-06-19
CVE-2026-3196 [CRITICAL] QEMU integer overflow
A vulnerability classified as critical has been found in QEMU. This vulnerability affects unknown code. Performing a manipulation results in integer overflow.
This vulnerability is identified as CVE-2026-3196. The attack is only possible with local access. There is not any exploit available.
Ubuntu
QEMU vulnerabilities
vendor_ubuntu·2026-04-09·CVSS 8.2
CVE-2024-6519 [HIGH] QEMU vulnerabilities
Title: QEMU vulnerabilities
Summary: Several security issues were fixed in QEMU.
It was discovered that the LSI53C895A SCSI Host Bus Adapter implementation
of QEMU incorrectly handled memory. An attacker inside the guest could
possibly use this issue to cause QEMU to crash, resulting in a denial of
service, or possibly execute arbitrary code. (CVE-2024-6519)
It was discovered that QEMU could be made to read out of bounds when
reading VMDK images. If a user or an automated system were tricked into
opening a specially crafted VMDK image, an attacker could possibly use
this issue to leak sensitive informaton or cause QEMU to crash, resulting
in a denial of service. (CVE-2026-2243)
It was discovered that the virtio-snd device implementation of QEMU could
be made to write out of bounds. An
Red Hat
qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation
vendor_redhat·2026-02-20·CVSS 5.5
CVE-2026-3196 [MEDIUM] CWE-190 qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation
qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation
An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition.
Statement: The `qemu-kvm` packages as shipped with Red Hat Enterprise Linux are not affected by this CVE. The virtio-snd device is disabled at build-time in RHEL, effectively removing the attack surface.
Package: qemu-kvm (Red Hat Enterprise Linux 10) - Not affected
Package: qemu-kvm (Red Hat Enterprise Linux 6) - Not affected
Package: qemu-kvm (Red Hat Enterprise Linux 7) - Not affected
Package: qemu-kvm-ma (Red Hat Enterprise Linux 7) - Not affec
Debian
CVE-2026-3196: qemu
vendor_debian·2026
CVE-2026-3196 [LOW] CVE-2026-3196: qemu
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 1:10.2.2+ds-1)
sid: resolved (fixed in 1:10.2.2+ds-1)
trixie: open
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-3196 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.3
CVE-2026-3196 [MEDIUM] CVE-2026-3196 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-3196 :
Linux Debian vulnerability analysis and mitigation
two potential OOB memory accesses in virtio-snd
Source : NVD
Published March 3, 2026
CNA Score N/A
Affected Technologies
Linux Debian
Linux Ubuntu
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) N/A
Exploitation Probability (EPSS) N/A
Affected packages and libraries
qemu
Sources
NVD
Debian 11 No Fix Added at: Mar 03, 2026
Debian 12, 13 Severity MEDIUM No Fix Added at: Mar 03, 2026
Debian 14 Has Fix Added at: Mar 03, 2026
Echo No Fix Added at: Mar 03, 2026
Ubuntu 24.04, 25.10 Severity MEDIUM No Fix Added at: Apr 02, 2026
## Get a CVE risk assessment
Get a prioritized view of CVEs in your cloud—so you can foc
Bugzilla
CVE-2026-3196 qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation
bugzilla·2026-03-02·CVSS 5.5
CVE-2026-3196 [MEDIUM] CVE-2026-3196 qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation
CVE-2026-3196 qemu-kvm: virtio-snd: integer overflow leading to unbounded memory allocation
An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition.
Upstream patch series:
https://lore.kernel.org/qemu-devel/[email protected]/
QEMU fix commit:
https://gitlab.com/qemu-project/qemu/-/commit/61679d7dcfa2dffc8fb115aa19b09e0e7cf5ea5c
Bugzilla
CVE-2026-3196 qemu: virtio-snd: integer overflow leading to unbounded memory allocation [fedora-all]
bugzilla·2026-03-02·CVSS 5.5
CVE-2026-3196 [MEDIUM] CVE-2026-3196 qemu: virtio-snd: integer overflow leading to unbounded memory allocation [fedora-all]
CVE-2026-3196 qemu: virtio-snd: integer overflow leading to unbounded memory allocation [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
Upstream patch series:
https://lore.kernel.org/qemu-devel/[email protected]/
QEMU fix commit:
https://gitlab.com/qemu-project/qemu/-/commit/61679d7dcfa2dffc8fb115aa19b09e0e7cf5ea5c
---
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.
2026-06-19
Published