AZL-91269

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91269.json
JSON Data
https://api.test.osv.dev/v1/vulns/AZL-91269
Upstream
Published
2026-06-19T17:16:22Z
Modified
2026-09-14T17:34:05Z
Summary
CVE-2026-3195 affecting package qemu for versions less than 9.1.0-9
Details

A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the virtio_snd_pcm_in_cb function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730.

References

Affected packages

Azure Linux:3 / qemu

Package

Name
qemu
Purl
pkg:rpm/azure-linux/qemu

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.1.0-9

Database specific

source 
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91269.json"