CVE-2017-9060: Memory leak in the virtio_gpu_set_scanout function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator)...

Security readout for executives and security teams

CVE-2017-9060 is a QEMU virtio-gpu memory leak. A user inside a guest operating system could consume host memory by repeatedly issuing scanout commands, potentially disrupting the hypervisor or other workloads. The sources describe denial of service, not data theft or code execution. Exposure is most relevant to virtualization hosts running QEMU with virtio-gpu enabled for guests, especially where guest users or tenants are untrusted. The supplied affected-products data is incomplete, so exact vulnerable versions cannot be confirmed from this bundle alone. Treat this as a targeted infrastructure hardening item, not an emergency internet-facing incident. Prioritize multi-tenant or untrusted-guest virtualization environments because one guest could degrade host stability and affect other workloads. Mitigation focus: Update QEMU through the operating system or virtualization vendor's supported packages.; Review vendor advisories for fixed package versions before scheduling remediation.; Disable or avoid virtio-gpu for untrusted guests where operationally feasible..

Prepared

Jun 13, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.