Skip to content
Threat Feed
Subscribe

Tag

Qemu

4 briefs RSS
high advisory

QEMU Guest Agent Vulnerability Allows Local Privilege Escalation (CVE-2026-12080)

A local unprivileged user within a QEMU guest can exploit CVE-2026-12080, a vulnerability in the QEMU Guest Agent's 'guest-ssh-add-authorized-keys' command handler, by manipulating symbolic links through a directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race to gain ownership of arbitrary root-owned files or directories, leading to root access within the guest OS.

QEMU Guest Agent +1 privilege-escalation vulnerability qemu guest-agent
2t 1c updated
critical threat

Payouts King Ransomware Abusing QEMU VMs for Defense Evasion

The Payouts King ransomware is leveraging QEMU VMs as a reverse SSH backdoor to execute payloads, store malicious files, and establish covert remote access tunnels, bypassing endpoint security measures.

GOLD ENCOUNTER payouts-king ransomware qemu vm defense-evasion
2r 8t 1c 1i
critical threat

QEMU Hypervisor Escape via virtio-snd 0-Day

An unpatched vulnerability in QEMU's virtio-snd component allows for a hypervisor escape due to an uncontrolled heap overflow.

virtualization hypervisor qemu virtio-snd heap overflow hypervisor escape
2r 2t
high advisory

Suspicious QEMU Execution on Windows

Detects the execution of QEMU with the -nographic flag and an image file on Windows systems, a technique used for persistence and initial access by installing a rogue Linux virtual machine.

Splunk Enterprise +3 qemu virtualization persistence linux windows
2r 2t