CVE-2021-3713: Debian Linux

High severity, CVSS 7.4. EPSS: 0.6% chance of exploitation in the next 30 days.

An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Qemu Qemu: up to and including 6.1.0

Published 2021-08-25. Last modified 2026-06-17.