Open Source QEMU

productDE

cpe:/a:qemu:qemu:-

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

5critical36high81medium19low

updated 2026-10-27

vulnerabilities (159)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2018-12617US	high7.5	25.1% (98th)	Exploit	no fix	2018-06-21	—
CVE-2019-14378US	high8.8	16.7% (97th)	Exploit	no fix	2019-07-29	—
CVE-2020-14364US	medium5.0	5.40% (93rd)	Exploit	no fix	2020-08-31	—
CVE-2017-13672US	medium5.5	0.95% (61st)	Exploit	no fix	2017-09-01	—
CVE-2026-12080US	—	0.14% (3rd)	Exploit	no fix	2026-07-20	—
CVE-2018-3640US	medium5.6	7.27% (94th)	—	no fix	2018-05-22	—
CVE-2018-17958US	high7.5	6.29% (94th)	—	no fix	2018-10-09	—
CVE-2019-12155US	high7.5	5.55% (93rd)	—	no fix	2019-05-24	—
CVE-2018-17963US	critical9.8	4.65% (92nd)	—	no fix	2018-10-09	—
CVE-2017-8309US	high7.5	4.54% (92nd)	—	no fix	2017-05-23	—
CVE-2018-17962US	high7.5	4.50% (91st)	—	no fix	2018-10-09	—
CVE-2018-20815US	critical9.8	4.43% (91st)	—	no fix	2019-05-31	—
CVE-2017-15268US	high7.5	4.27% (91st)	—	no fix	2017-10-12	—
CVE-2017-9524US	high7.5	4.09% (91st)	—	no fix	2017-07-06	—
CVE-2020-1711US	medium6.0	4.02% (91st)	—	no fix	2020-02-11	—
CVE-2017-6058US	high7.5	3.92% (90th)	—	no fix	2017-03-20	—
CVE-2017-8380US	critical9.8	3.91% (90th)	—	no fix	2017-08-28	—
CVE-2018-20216US	high7.5	3.88% (90th)	—	no fix	2018-12-20	—
CVE-2017-13711US	high7.5	3.84% (90th)	—	no fix	2017-09-01	—
CVE-2018-20191US	high7.5	3.72% (90th)	—	no fix	2018-12-20	—
CVE-2018-20125US	high7.5	3.68% (90th)	—	no fix	2018-12-20	—
CVE-2018-10839US	medium6.5	3.08% (88th)	—	no fix	2018-10-16	—
CVE-2017-2633US	medium6.5	3.08% (88th)	—	no fix	2018-07-27	—
CVE-2017-13673US	medium6.5	2.96% (87th)	—	no fix	2017-08-29	—
CVE-2019-12247US	high7.5	2.96% (87th)	—	no fix	2019-05-22	—
CVE-2017-16845US	critical10.0	2.94% (87th)	—	no fix	2017-11-17	—
CVE-2017-15124US	high7.5	2.84% (87th)	—	no fix	2018-01-09	—
CVE-2022-26353US	high7.5	2.74% (86th)	—	no fix	2022-03-16	—
CVE-2017-2630US	high8.8	2.65% (86th)	—	no fix	2018-07-27	—
CVE-2020-27617US	medium6.5	2.57% (85th)	—	no fix	2020-11-06	—
CVE-2020-27616US	medium6.5	2.53% (85th)	—	no fix	2020-11-06	—
CVE-2020-8608US	medium5.6	2.49% (85th)	—	no fix	2020-02-06	—
CVE-2020-13765US	medium5.6	2.46% (84th)	—	no fix	2020-06-04	—
CVE-2020-11102US	medium5.6	1.97% (80th)	—	no fix	2020-04-06	—
CVE-2023-3255US	medium6.5	1.89% (79th)	—	no fix	2023-09-13	—
CVE-2020-29130US	medium4.3	1.89% (79th)	—	no fix	2020-11-26	—
CVE-2023-3354US	high7.5	1.61% (76th)	—	no fix	2023-07-11	—
CVE-2022-3165US	medium6.5	1.55% (75th)	—	no fix	2022-10-17	—
CVE-2020-29129US	medium4.3	1.46% (73rd)	—	no fix	2020-11-26	—
CVE-2023-6683US	medium6.5	1.26% (69th)	—	no fix	2024-01-12	—
CVE-2018-16872US	medium5.3	1.07% (65th)	—	no fix	2018-12-13	—
CVE-2019-20382US	low3.5	0.87% (58th)	—	no fix	2020-03-05	—
CVE-2025-11234US	—	0.86% (58th)	—	no fix	2025-10-03	—
CVE-2017-7471US	critical9.0	0.85% (58th)	—	no fix	2018-07-09	—
CVE-2021-4206US	high8.2	0.83% (57th)	—	no fix	2022-04-29	—
CVE-2018-5683US	medium6.0	0.68% (52nd)	—	no fix	2018-01-23	—
CVE-2020-28916US	medium5.5	0.66% (51st)	—	no fix	2020-12-04	—
CVE-2024-6505US	—	0.66% (51st)	—	no fix	2024-07-05	—
CVE-2020-25085US	medium5.0	0.63% (50th)	—	no fix	2020-09-25	—
CVE-2018-7550US	high8.8	0.61% (49th)	—	no fix	2018-03-01	—

showing 50 of 159

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-125Out-of-bounds Read28 CVEs
CWE-787Out-of-bounds Write26 CVEs
CWE-190Integer Overflow or Wraparound15 CVEs
CWE-476NULL Pointer Dereference14 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer10 CVEs
CWE-416Use After Free10 CVEs
CWE-772Missing Release of Resource after Effective Lifetime10 CVEs
CWE-122Heap-based Buffer Overflow9 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)159 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan