CVE-2026-15578

CVE Details

Release Date:	2026-09-03
Impact:	Low	What is this?

Description

In QEMU's VNC server implementation (ui/vnc.c), the set_pixel_format() function does not properly validate the red_max, green_max, and blue_max fields from a client's SetPixelFormat message. These fields are received as 16-bit values but are stored internally as uint8_t. A malicious VNC client can send a max value above 255 (e.g., 0x0100) which passes the existing non-zero validation check but silently truncates to 0 upon assignment, leading to a division by zero in the Tight PNG palette encoding path. This allows a remote attacker to crash the QEMU process, resulting in a denial of service for all guests served by that QEMU instance. Fixed in QEMU v11.0.3 and v10.0.12.

See more information about CVE-2026-15578 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v3 metrics

Base Score:	7.5
Vector String:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version:	3.1
Attack Vector:	Network
Attack Complexity:	Low
Privileges Required:	None
User Interaction:	None
Scope:	Unchanged
Confidentiality Impact:	None
Integrity Impact:	None
Availability Impact:	High

Errata information

Platform	Errata	Release Date
Oracle Linux version 9 (qemu-kvm)	ELSA-2026-500245	2026-09-03