{"id":"CVE-2026-46655","summary":"virtio-win: Integer overflow causing a heap overflow in Viosock driver","details":"virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTL_SELECT request with attacker-controlled VIRTIO_VSOCK_SELECT.Fdss[*].fd_count values that overflow the 32-bit sum used by VIOSockSelect for bounds checking. The wrapped sum can pass the FD_SETSIZE check even though an individual descriptor count is much larger than the expected limit. VIOSockSelectCopyFds then iterates using the unchecked count and writes beyond the allocated pPkt-\u003eFds array in the NonPagedPool kernel heap. Successful exploitation can corrupt kernel memory and enable privilege escalation in a Windows guest running the driver. This issue is fixed in mm320.","aliases":["GHSA-qrhp-4mhp-hjwh"],"modified":"2026-09-20T14:24:43.971179Z","published":"2026-09-18T16:46:34.832Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-122","CWE-190"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46655.json"},"references":[{"type":"WEB","url":"https://github.com/virtio-win/kvm-guest-drivers-windows/releases/tag/mm320"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46655.json"},{"type":"ADVISORY","url":"https://github.com/virtio-win/kvm-guest-drivers-windows/security/advisories/GHSA-qrhp-4mhp-hjwh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46655"},{"type":"FIX","url":"https://github.com/virtio-win/kvm-guest-drivers-windows/commit/c6bef93d7909584bbda4e5c87603ea175825f342"},{"type":"FIX","url":"https://github.com/virtio-win/kvm-guest-drivers-windows/pull/1568"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/virtio-win/kvm-guest-drivers-windows","events":[{"introduced":"76eab1fcf2bd94182538e519900791ccb0d88810"},{"fixed":"c6bef93d7909584bbda4e5c87603ea175825f342"},{"fixed":"e295fa32fe9e3219b63e4055971b97dc9f7d84f5"}],"database_specific":{"extracted_events":[{"introduced":"mm210"},{"fixed":"mm320"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["mm319","mm318","mm317","mm316","mm315","mm314","mm313","mm312","mm286","mm282","mm268","01.11.2023-last-buildable-point-Win8","mm260","mm249","mm245","mm241","mm237","mm235","02.12.2021-last-buildable-point-Win7","mm228","mm224","08.03.2021-last-buldable-point-XP","mm216","mm210"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-46655.json","vanir_signatures_modified":"2026-09-20T14:24:43Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/virtio-win/kvm-guest-drivers-windows/commit/c6bef93d7909584bbda4e5c87603ea175825f342","target":{"file":"viosock/sys/Device.c"},"deprecated":false,"digest":{"line_hashes":["257269614564495422387372943986302016076","56121719056322984262217181978164689248","95213728126496253239617302969967051612","781054844622847279745456316596124238","248155876438362162941235533562420237854","113627483962707409465590661187875545649","316353147794372185831554733553772452510","185818641677448765431671204115498372242","17653417256783036034800459754685681412"],"threshold":0.9},"id":"CVE-2026-46655-29168439"},{"id":"CVE-2026-46655-6f733ffe","signature_type":"Function","signature_version":"v1","source":"https://github.com/virtio-win/kvm-guest-drivers-windows/commit/c6bef93d7909584bbda4e5c87603ea175825f342","target":{"file":"viosock/sys/Device.c","function":"VIOSockSelect"},"deprecated":false,"digest":{"function_hash":"185707896953127633483900136339374502993","length":2456}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}