CVE-2015-5158: Qemu

Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days.

Stack-based buffer overflow in hw/scsi/scsi-bus.c in QEMU, when built with SCSI-device emulation support, allows guest OS users with CAP_SYS_RAWIO permissions to cause a denial of service (instance crash) via an invalid opcode in a SCSI command descriptor block.

Affected products

• Qemu Qemu: from 2.2.0, before 2.4.0 (fixed in 2.4.0); version 2.4.0 only

Published 2016-04-12. Last modified 2026-06-17.