CVE-2016-9845: QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information...

Security readout for executives and security teams

This flaw can let a user or process inside a virtual machine read bytes from the host’s memory when QEMU uses Virtio GPU device emulation. That breaks an important isolation boundary. The sources do not show active exploitation or a CVSS score, so urgency depends on whether untrusted guests use Virtio GPU. Exposure is likely limited to QEMU environments built with Virtio GPU device emulator support, especially where guests can use virtio-gpu-3d or virgl features. The source bundle does not provide exact affected versions or CPEs. Prioritize if QEMU hosts run untrusted or tenant-controlled virtual machines with Virtio GPU enabled. For isolated, trusted guest environments, handle through normal patch management. The business risk is disclosure of host memory across a virtualization boundary. Mitigation focus: Apply QEMU or distribution updates that include the virtio-gpu capset information leak fix.; Review Gentoo and upstream QEMU guidance for exact fixed package versions.; Disable Virtio GPU 3D or virgl features for untrusted guests where feasible..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.