CVE-2020-13253

MEDIUM 5.5CVE-2020-13253 · Published 27/05/2020 · updated 17/06/2026

In short

CVE-2020-13253 is a MEDIUM (CVSS 5.5) vulnerability affecting qemu (qemu).
Chance of exploitation in the next 30 days (EPSS): 0.43%, higher than 37.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
qemu qemu	`≤ 5.0.1`	No fix yet

Description

sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.

References

openwall.com/lists/oss-security/2020/05/27/2 · Mailing List
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
lists.debian.org/debian-lts-announce/2020/09/msg00013.html · Mailing List
lists.debian.org/debian-lts-announce/2022/09/msg00008.html · Mailing List
lists.gnu.org/archive/html/qemu-devel/2020-05/msg05835.html · Mailing List
security.gentoo.org/glsa/202011-09 · Third Party Advisory
usn.ubuntu.com/4467-1 · Third Party Advisory

More vulnerabilities in qemu

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

qemu

≤ 5.0.1

No fix yet

More vulnerabilities in qemu

See all →