Unrated

QEMU virtio-gpu calc_image_hostmem Integer Overflow Local Privilege Escalation

IdentifiersCVE-2026-3886CWE-190

CVE-2026-3886 is a local privilege escalation vulnerability in QEMU, disclosed as ZDI-26-332. The flaw exists in the virtio-gpu driver, specifically in processing associated with calc_image_hostmem, where improper validation of user-supplied data can trigger an integer overflow prior to buffer allocation. This miscalculation can lead to an undersized allocation followed by memory corruption conditions that are exploitable by an attacker. A successful exploit allows arbitrary code execution in the context of the host system from a low-privileged position in the guest.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can break guest-to-host isolation and result in arbitrary code execution on the host system. Because the issue is reachable by an attacker with low-privileged code execution on the guest, the practical impact is host compromise with high confidentiality, integrity, and availability impact. This aligns with the reported CVSS 8.8 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Mitigation

If you can’t patch tonight, do this now.

Until patched, reduce exposure by disabling or avoiding use of the vulnerable virtio-gpu functionality where operationally feasible, and prevent untrusted users from obtaining code execution within guest systems that can access the affected virtual device. Restrict local guest access, minimize use of shared or multi-tenant guest environments, and monitor for abnormal guest interactions with virtio-gpu devices. Specific vendor mitigation guidance beyond patching is not available in the provided content.

Remediation

Patch, then assume compromise.

Apply the vendor-provided QEMU update that corrects the virtio-gpu integer overflow condition. The available content indicates QEMU issued a fix and that a patch reference was published via patchew.org. Upgrade to a patched release incorporating that fix and redeploy affected hosts and guest stacks as appropriate.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

5 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity4