Skip to content
Threat Feed
Subscribe

Product

QEMU Guest Agent

1 brief RSS
high advisory

QEMU Guest Agent Vulnerability Allows Local Privilege Escalation (CVE-2026-12080)

A local unprivileged user within a QEMU guest can exploit CVE-2026-12080, a vulnerability in the QEMU Guest Agent's 'guest-ssh-add-authorized-keys' command handler, by manipulating symbolic links through a directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race to gain ownership of arbitrary root-owned files or directories, leading to root access within the guest OS.

QEMU Guest Agent privilege-escalation vulnerability qemu guest-agent
2t 1c