CVE-2016-10028: The virgl_cmd_get_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Vir...

Security readout for executives and security teams

CVE-2016-10028 is a QEMU denial-of-service issue in Virtio GPU 3D support. A user inside a guest OS can trigger an out-of-bounds read that crashes the QEMU process. The cited material does not show host code execution or active exploitation. Most relevant to virtualization hosts running older QEMU with Virtio GPU 3D or Virgl support enabled for guests. Systems without that device support, or without untrusted guest users, are less exposed. Exact affected versions are not provided in the bundle. Treat this as a targeted availability risk for virtualization platforms, not a broad network-exploitable emergency. Prioritize hosts that run untrusted guests or desktop/graphics-enabled VMs, and remediate through normal hypervisor patch management. Mitigation focus: Update QEMU through the relevant OS or virtualization vendor channel.; Apply the upstream QEMU fix if maintaining a custom build.; Disable Virtio GPU 3D or Virgl support where it is not required..

Prepared

Jun 13, 2026, 06:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.