Description
An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati-2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1:5.0-1 | — |
| Debian 13 | qemu | 1:5.0-1 | — |
| Debian 12 | qemu | 1:5.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | qemu | 1:4.2-3ubuntu6.1 | USN-4372-1 |
| Ubuntu 18.04 LTS | qemu | 1:2.11+dfsg-1ubuntu7.26 | USN-4372-1 |
| Ubuntu 16.04 LTS | qemu | 1:2.5+dfsg-5ubuntu10.44 | USN-4372-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | qemu | 6.1.0-32.1 | openSUSE-SU-2024:11287-1 |
Advisories 3
- USN-4372-1 qemu vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2024:11287-1 qemu-6.1.0-32.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2024-1978 QEMU: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 2, 2024