CVE-2018-12617: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 25.1% chance of exploitation in the next 30 days.

qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 16.04 only; version 18.04 only; version 18.10 only
• Debian Debian Linux: version 8.0 only; version 9.0 only
• Qemu Qemu: up to and including 2.12.50

Published 2018-06-21. Last modified 2026-06-17.