AZL-78174

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-78174.json

JSON Data

https://api.test.osv.dev/v1/vulns/AZL-78174

Upstream

CVE-2025-14876

Published

2026-02-18T21:16:20Z

Modified

2026-04-01T05:23:11.854993Z

Summary

CVE-2025-14876 affecting package qemu 9.1.0-1

Details

A flaw was found in the virtio-crypto device of QEMU. A malicious guest operating system can exploit a missing length limit in the AKCIPHER path, leading to uncontrolled memory allocation. This can result in a denial of service (DoS) on the host system by causing the QEMU process to terminate unexpectedly.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-14876

Affected packages

Azure Linux:3 / qemu

Package

Name: qemu
Purl: pkg:rpm/azure-linux/qemu

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

9.1.0-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-78174.json"