CVE-2021-3507: Debian Linux

Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days.

A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the floppy drive to the guest system. A privileged guest user could use this flaw to crash the QEMU process on the host resulting in DoS scenario, or potential information leakage from the host memory.

Affected products

• Debian Debian Linux: version 10.0 only
• Qemu Qemu: up to and including 6.0.0
• Red Hat Enterprise Linux: version 8.0 only

Published 2021-05-06. Last modified 2026-06-17.