Remy Noel

**Name of the Vulnerable Software and Affected Versions** QEMU (affected versions not specified) **Description** A flaw was found in the USB redirector device of QEMU, where small USB packets are combined into a single, large transfer request to improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array on the stack without proper validation, allowing a malicious guest to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.