CVE-2008-2004: Qemu

Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days.

The drive_init function in QEMU 0.9.1 determines the format of a raw disk image based on the header, which allows local guest users to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted.

Affected products

• Qemu Qemu: version 0.9.1 only

Published 2008-05-12. Last modified 2026-06-16.