CVE-2019-18389

HIGH 7.8CVE-2019-18389 · Published 23/12/2019 · updated 17/06/2026

In short

CVE-2019-18389 is a HIGH (CVSS 7.8) vulnerability affecting virglrenderer (virglrenderer project).
Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.2% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
virglrenderer virglrenderer_project	`≤ 0.8.0`	No fix yet

Description

A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service, or QEMU guest-to-host escape and code execution, via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.

References

lists.opensuse.org/opensuse-security-announce/2020-01/msg00028.html · Mailing List
access.redhat.com/security/cve/cve-2019-18389 · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
gitlab.freedesktop.org/virgl/virglrenderer/commit/cbc8d8b75be360236cada63784046688aeb6d921 · Patch
gitlab.freedesktop.org/virgl/virglrenderer/merge_requests/314/diffs · Patch
lists.debian.org/debian-lts-announce/2022/12/msg00017.html · Mailing List

More vulnerabilities in virglrenderer

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

virglrenderer

virglrenderer_project

≤ 0.8.0

No fix yet

More vulnerabilities in virglrenderer

See all →