CVEvulnerability

CVE-2026-81627

8.2 HIGH Published 2026-09-18 Modified 2026-09-21 Official page ↗
Status
Awaiting Analysis
Published
2026-09-18
Last modified
2026-09-21
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.2 HIGH — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-787

Description

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory.

Related

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References