PT-2025-35349 · Qemu+1 · Qemu+1

Published 2025-01-01 · Updated 2026-02-18 · CVE-2025-8860

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions qemu (affected versions not specified)

Description The vulnerability involves an information disclosure issue in QEMU. A heap buffer is allocated without being zeroed, potentially exposing residual data from prior allocations. This data can be read back to the guest when accessing register UEFI VARS REG PIO BUFFER TRANSFER via the uefi vars read callback function, leading to the disclosure of sensitive process memory or metadata. The issue occurs when a guest writes to register UEFI VARS REG BUFFER SIZE, triggering the uefi vars write callback.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-212

Related Identifiers

CVE-2025-8860

ZDI-25-884

Affected Products

Debian

Qemu

References · 11

• https://osv.dev/vulnerability/DEBIAN-CVE-2025-8860 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-884 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-8860 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-8860 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-8860 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-8860 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-8860 · Vendor Advisory
• https://twitter.com/CVEnew/status/2024233231495602325 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2387588 · Note
• https://twitter.com/SystemTek_UK/status/1964394257113813157 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2025-8860 · Note