CVE-2025-12464
MEDIUM EPSS 6.0%
Published Oct 31, 20258mo ago · Modified Jun 17, 20261w ago
6.2 CVSS 3.1
Published Oct 31, 2025 8mo ago
Last Modified Jun 17, 2026 1w ago
Description
A stack-based buffer overflow was found in the QEMU e1000 network device. The code for padding short frames was dropped from individual network devices and moved to the net core code. The issue stems from the device's receive code still being able to process a short frame in loopback mode. This could lead to a buffer overrun in the e1000_receive_iov() function via the loopback code path. A malicious guest user could use this vulnerability to crash the QEMU process on the host, resulting in a denial of service.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High
Threat Intelligence
EPSS Exploit Probability
6.0% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-121
References 3
- access.redhat.com https://access.redhat.com/security/cve/CVE-2025-12464
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2408845
- gitlab.com https://gitlab.com/qemu-project/qemu/-/issues/3043
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.