Open Source QEMU

Name: Open Source QEMU
Brand: Open Source

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

1critical6high14medium1low

updated 2026-10-27

vulnerabilities (24)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-3929US	high8.2	0.68% (52nd)	Exploit	no fix	2022-08-25	≤ 6.2.0 rc2
CVE-2021-3682US	high8.5	2.88% (87th)	—	6.1.0-rc2	2021-08-05	< 6.1.0-rc2
CVE-2022-36648US	critical10.0	1.74% (78th)	—	no fix	2023-08-22	≤ 7.0.0
CVE-2024-24474US	—	1.40% (72nd)	—	8.2.0	2024-02-20	< 8.2.0
CVE-2022-35414US	high8.8	0.66% (52nd)	—	no fix	2022-07-11	≤ 7.0.0
CVE-2024-26327US	medium5.3	0.60% (48th)	—	no fix	2024-02-19	≤ 8.2.1
CVE-2021-3750US	high8.2	0.51% (44th)	—	7.0.0	2022-05-02	< 7.0.0
CVE-2020-17380US	medium6.3	0.44% (38th)	—	no fix	2021-01-30	≤ 5.0.0
CVE-2019-3812US	medium5.5	0.43% (37th)	—	no fix	2019-02-19	2 versions
CVE-2021-3582US	medium6.5	0.39% (33rd)	—	2.17.2	2022-03-25	< 2.17.2
CVE-2017-12809US	medium6.5	0.39% (33rd)	—	2.10	2017-08-23	< 2.10
CVE-2020-25723US	low3.2	0.36% (30th)	—	5.2.0	2020-12-02	< 5.2.0
CVE-2020-27821US	medium6.0	0.36% (30th)	—	5.2.0	2020-12-08	< 5.2.0
CVE-2023-40360US	medium5.5	0.36% (30th)	—	no fix	2023-08-14	≤ 8.0.4
CVE-2019-20808US	medium6.5	0.33% (27th)	—	4.2.0	2020-12-31	< 4.2.0
CVE-2021-20181US	high7.5	0.33% (26th)	—	5.0.0-rc3	2021-05-13	< 5.0.0-rc3
CVE-2020-10702US	medium5.5	0.33% (26th)	—	no fix	2020-06-04	≤ 4.2.0
CVE-2021-3947US	medium5.5	0.32% (24th)	—	6.2.0-rc2	2022-02-18	< 6.2.0-rc2
CVE-2024-3446US	—	0.30% (23rd)	—	9.0	2024-04-09	< 9.0
CVE-2024-26328US	medium6.0	0.29% (21st)	—	no fix	2024-02-19	≤ 8.2.1
CVE-2025-54567US	medium5.4	0.29% (21st)	—	no fix	2025-07-25	≤ 10.0.3
CVE-2025-54566US	medium5.4	0.29% (21st)	—	no fix	2025-07-25	≤ 10.0.3
CVE-2023-3301US	medium5.6	0.26% (18th)	—	qemu-kvm-8.0.0-7.el9	2023-09-13	< qemu-kvm-8.0.0-7.el9
CVE-2026-81627US	high8.2	0.19% (9th)	—	no fix	2026-09-18	≤ 11.1.0

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-787Out-of-bounds Write5 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer4 CVEs
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')3 CVEs
CWE-125Out-of-bounds Read3 CVEs
CWE-416Use After Free3 CVEs
CWE-476NULL Pointer Dereference3 CVEs
CWE-122Heap-based Buffer Overflow2 CVEs
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')2 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)24 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan