CVE-2015-5165: The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and ea...

Security readout for executives and security teams

This is a memory disclosure issue in QEMU's emulated RTL8139 network card, used with Xen 4.5.x and earlier. An attacker could read heap memory from the device-model process. The bundle does not show active exploitation or a CVSS score, so urgency depends on whether affected Xen/QEMU hosts remain in use. Exposure is most likely on legacy Xen/QEMU virtualization hosts using the emulated RTL8139 network card, especially Xen 4.5.x or earlier. Modern environments may be unaffected if they no longer run these versions or device models, but the provided affected-product data is incomplete. Prioritize if the organization still operates legacy Xen/QEMU infrastructure. The issue can expose process memory, but the bundle lacks CVSS, affected-version precision beyond Xen 4.5.x and earlier, and evidence of active exploitation. Mitigation focus: Inventory Xen/QEMU hosts and identify any Xen 4.5.x or earlier deployments.; Apply relevant vendor security updates from Red Hat, Debian, SUSE, Citrix, Oracle, or Fedora.; Check vendor guidance for product-specific mitigations or fixed package versions..

Prepared

Jun 13, 2026, 22:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.