CVE-2016-9911: n/a vulnerability

CVE-2016-9911: Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue.

Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_init_transfer'. A guest user/process could use this issue to leak host memory, resulting in DoS for a host.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 6, 2024, 03:07 UTC (UTC+00:00)

Security readout for executives and security teams

CVE-2016-9911 is a QEMU USB EHCI emulation memory leak. A user or process inside a guest VM could cause host memory to leak, potentially degrading or denying service on the virtualization host. Exposure is most likely on virtualization hosts running affected QEMU builds with USB EHCI emulation enabled or available to guests. Exact affected versions are not provided in the bundle. Prioritize hosts running untrusted or multi-tenant VMs, because the impact crosses from guest activity to host availability. Treat as a patch-management issue unless local exposure is widespread. Mitigation focus: Check Debian, Red Hat, Gentoo, or other vendor QEMU advisories for applicable updates.; Apply vendor-provided QEMU security updates where your packages are affected.; Review whether guest USB EHCI emulation is required in exposed VM profiles..

Prepared: Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2016-9911 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Dec 23, 2016, 22:00 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security updateCVE reference · mailing-list, x_refsource_MLIST
RHSA-2017:2392CVE reference · vendor-advisory, x_refsource_REDHAT
GLSA-201701-49CVE reference · vendor-advisory, x_refsource_GENTOO
RHSA-2017:2408CVE reference · vendor-advisory, x_refsource_REDHAT

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.