{"id":"AZL-92502","summary":"CVE-2026-3842 affecting package qemu for versions less than 9.1.0-11","details":"A flaw was found in QEMU. This vulnerability allows a local attacker within a guest virtual machine to write data beyond its allocated memory. This occurs when cpu_physical_memory_map() returns a shorter length than expected, leading to an out-of-bounds write. Successful exploitation could result in unauthorized access to guest memory or corruption of heap-allocated objects, potentially causing information disclosure, data integrity issues, or a denial of service.","modified":"2026-09-03T05:27:10Z","published":"2026-07-16T01:16:30Z","upstream":["CVE-2026-3842"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3842"}],"affected":[{"package":{"name":"qemu","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/qemu"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.0-11"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-92502.json"}}],"schema_version":"1.9.0"}