Heap-based buffer overflow in QEMU - CVE-2016-9603
Published: June 6, 2017 / Updated: December 9, 2025
Vulnerability identifier: #VU6934
CSH Severity: High
CVSS v4: 9.4 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2016-9603
CWE-ID: CWE-122
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in Cirrus CLGD 54xx VGA emulator's VNC display driver when a VNC client attempted to update its display after a VGA operation is performed by a guest. A local user inside a guest VM can trigger a hea-based buffer overflow and execute arbitrary code with privileges of the QEMU process.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
QEMU
xen (Alpine package)
xen (Alpine package)
How to mitigate CVE-2016-9603
Install update from vendor's website.
QEMU - update to 2.9.0
xen (Alpine package) - update to 4.5.5-r1
xen (Alpine package) - update to 4.5.5-r1