CVE-2013-4535: Qemu

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related to virtio-block or virtio-serial read.

Affected products

• Qemu Qemu: before 1.7.2 (fixed in 1.7.2)
• Red Hat Enterprise Linux Desktop: version 6.0 only
• Red Hat Enterprise Linux Server: version 6.0 only
• Red Hat Enterprise Linux Server Tus: version 6.5 only
• Red Hat Enterprise Linux Workstation: version 6.0 only
• Red Hat Virtualization: version 3.0 only

Published 2020-02-11. Last modified 2026-06-16.