Red Hat Virtio-Win vulnerabilities

3 CVEs affecting Red Hat Virtio-Win, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-5165, published 2026-03-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-3215, published 2017-06-26. High severity, CVSS 7.5. EPSS: 1.8% chance of exploitation in the next 30 days. The NetKVM Windows Virtio driver allows remote attackers to cause a denial of service (guest crash) via a crafted length value in an IP packet, as demonstrated by a value that does not account for…
CVE-2026-5164, published 2026-03-30. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in virtio-win. The `RhelDoUnMap()` function does not properly validate the number of descriptors provided by a user during an unmap request. A local user could exploit this input…
CVE-2026-5165, published 2026-03-30. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in virtio-win, specifically within the VirtIO Block (BLK) device. When the device undergoes a reset, it fails to properly manage memory, resulting in a use-after-free vulnerability.…