Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the emulated Xen physdev hypercall interface, leading to a denial of service or potential memory corruption.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-06 | 1 | General1 |
| 2026-02-18 | 1 | Disclosure1 |
| 2026-03-17 | 1 | General1 |
The severity is increased for this new vulnerability affecting QEMU (CVE-2026-0665) https://vuldb.com/?id.344679
Post summary
The text briefly notes a severity increase for CVE-2026-0665 affecting QEMU, but provides no details on exploitation, patching, or technical specifics.
I think it depends on the setup. We reported a heap off-by-one in KVM’s Xen support earlier this year, so the code base is not that perfect I think. However, the bug (CVE-2026-0665) was just a MEDIUM (i think it’s fair) because it need to be attacked from a Xen guest, which is not considered in kvmctf 😂
Post summary
The post discusses CVE-2026-0665 as a heap off-by-one in KVM’s Xen support, noting it earned a medium severity due to requiring a Xen guest, with no PoC, exploit code, patch, or active exploitation mentioned.
CVE-2026-0665 An off-by-one error was found in QEMU's KVM Xen guest support. A malicious guest could use this flaw to trigger out-of-bounds heap accesses in the QEMU process via the … https://www.cve.org/CVERecord?id=CVE-2026-0665
Post summary
An off-by-one error in QEMU's KVM Xen guest support can lead to out-of-bounds heap accesses in the QEMU process, with no PoC, exploit, or patch information provided.