Red Hat Enterprise Linux 8 Advanced Virtualization vulnerabilities

10 CVEs affecting Red Hat Enterprise Linux 8 Advanced Virtualization, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-8860, published 2026-02-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-7409, published 2024-08-05. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server…
CVE-2024-4418, published 2024-05-08. Medium severity, CVSS 6.2. EPSS: 0.5% chance of exploitation in the next 30 days. A race condition leading to a stack use-after-free flaw was found in libvirt. Due to a bad assumption in the virNetClientIOEventLoop() method, the `data` pointer to a stack-allocated…
CVE-2024-1441, published 2024-03-11. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. An off-by-one error flaw was found in the udevListInterfacesByStatus() function in libvirt when the number of interfaces exceeds the size of the `names` array. This issue can be reproduced by sending…
CVE-2024-7383, published 2024-08-05. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD…
CVE-2024-2494, published 2024-03-21. Medium severity, CVSS 6.2. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points.…
CVE-2024-4467, published 2024-07-02. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process…
CVE-2024-4693, published 2024-05-14. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads to a guest triggerable crash via…
CVE-2024-3446, published 2024-04-09. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues.…
CVE-2024-8612, published 2024-09-20. Low severity, CVSS 3.8. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete /…
CVE-2025-8860, published 2026-02-18. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is invoked. The function allocates a heap…