tag
Guest-to-Host
CVE-2026-35250
binary
LOW 2.3
VirtualBox DevVGA_VBVA Integer Overflow leading to Guest-Triggerable DoS (CVE-2026-35250)
VirtualBox's DevVGAVBVA.cpp dimension-validation check uses a logical OR where an AND is required, letting a malicious guest supply width=0x80000001, height=16 and pass the bounds check. The resulting pointer-data size calculation (cbPointerData) then…
Unverified
2026-07-05
None assigned as of 2026-07-03
binary
CRITICAL
QEMU CXL Type-3 Mailbox Guest-to-Host Escape
QEMU's CXL Type-3 mailbox command handling contains two related out-of-bounds issues: the GETLOG handler validates offset + length as a byte range but then uses offset as an array index into cci->cellog, and the SETFEATURE rank-sparing handler copies…
Unverified
2026-07-03