High
Qemu-kvm: vnc websocket handshake use-after-free
Type: advisorySources: OSV
A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2025-11234
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 01:45 UTC · Revision 1
Source evidence
Qemu-kvm: vnc websocket handshake use-after-free
core-osv · Original sourcePublished 3 Oct 2025, 10:30 UTC
A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.
osv:CVE-2025-11234
Complete source record
{
"id": "6b6b9e320aa3f1daeb6d561ce0f7919b53644bbbc444b5183b19c39c0f8cc4a9",
"url": "https://osv.dev/vulnerability/CVE-2025-11234",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Qemu-kvm: vnc websocket handshake use-after-free",
"summary": "A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.",
"evidence": "osv:CVE-2025-11234",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2025-11234",
"aliases": [
"CVE-2025-11234"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://gitlab.com/qemu-project/qemu",
"type": "GIT",
"events": [
{
"introduced": "bfc766d38e1fae5767d43845c15c79ac8fa6d6af"
},
{
"fixed": "ccaea6b2656ec6eab966585f7b16438208f98de7"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "2.6.0"
},
{
"fixed": "10.1.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
}
],
"versions": [
"v10.1.1",
"v10.1.0",
"v10.1.0-rc4",
"v10.1.0-rc3",
"v10.1.0-rc2",
"v10.1.0-rc1",
"v10.1.0-rc0",
"v10.0.0",
"v10.0.0-rc4",
"v10.0.0-rc3",
"v10.0.0-rc2",
"v10.0.0-rc1",
"v10.0.0-rc0",
"v9.2.0",
"v9.2.0-rc3",
"v9.2.0-rc0",
"v9.2.0-rc2",
"v9.2.0-rc1",
"v9.1.0",
"v9.1.0-rc4",
"v9.1.0-rc3",
"v9.1.0-rc2",
"v9.1.0-rc1",
"v9.1.0-rc0",
"v9.0.0",
"v9.0.0-rc4",
"v9.0.0-rc3",
"v9.0.0-rc2",
"v9.0.0-rc1",
"v9.0.0-rc0",
"v8.2.0",
"v8.2.0-rc4",
"v8.2.0-rc3",
"v8.2.0-rc2",
"v8.2.0-rc1",
"v8.2.0-rc0",
"v8.1.0",
"v8.1.0-rc4",
"v8.1.0-rc3",
"v8.1.0-rc2",
"v8.1.0-rc1",
"v8.1.0-rc0",
"v8.0.0",
"v8.0.0-rc4",
"v8.0.0-rc3",
"v8.0.0-rc2",
"v7.2.0",
"v8.0.0-rc1",
"v8.0.0-rc0",
"v7.2.0-rc4",
"v7.2.0-rc3",
"v7.2.0-rc2",
"v7.2.0-rc1",
"v7.2.0-rc0",
"v7.1.0",
"v7.1.0-rc4",
"v7.1.0-rc3",
"v7.1.0-rc2",
"v7.1.0-rc1",
"v7.1.0-rc0",
"v7.0.0",
"v7.0.0-rc4",
"v7.0.0-rc3",
"v7.0.0-rc2",
"v7.0.0-rc1",
"v7.0.0-rc0",
"v6.2.0",
"v6.2.0-rc4",
"v6.1.0",
"v6.2.0-rc3",
"v6.2.0-rc1",
"v6.2.0-rc0",
"v6.0.0",
"v6.1.0-rc4",
"v6.1.0-rc3",
"v6.1.0-rc2",
"v6.1.0-rc1",
"v6.1.0-rc0",
"v6.0.0-rc5",
"v6.0.0-rc4",
"v6.0.0-rc3",
"v6.0.0-rc2",
"v6.0.0-rc1",
"v6.0.0-rc0",
"v5.2.0",
"v5.2.0-rc4",
"v5.2.0-rc3",
"v5.2.0-rc2",
"v5.2.0-rc1",
"v5.2.0-rc0",
"v5.0.0",
"v5.1.0",
"v5.1.0-rc3",
"v5.1.0-rc2",
"v5.1.0-rc1",
"v5.1.0-rc0",
"v4.2.0",
"v5.0.0-rc4",
"v5.0.0-rc3",
"v5.0.0-rc2",
"v5.0.0-rc1",
"v5.0.0-rc0",
"v4.2.0-rc5",
"v4.2.0-rc4",
"v4.2.0-rc3",
"v4.2.0-rc2",
"v4.2.0-rc1",
"v4.2.0-rc0",
"v4.1.0",
"v4.0.0",
"v4.1.0-rc5",
"v4.1.0-rc4",
"v4.1.0-rc3",
"v4.1.0-rc2",
"v4.1.0-rc1",
"v4.1.0-rc0",
"v4.0.0-rc4",
"v4.0.0-rc3",
"v4.0.0-rc2",
"v4.0.0-rc1",
"v3.1.0",
"v4.0.0-rc0",
"v3.0.0",
"v3.1.0-rc5",
"v3.1.0-rc4",
"v3.1.0-rc3",
"v3.1.0-rc2",
"v3.1.0-rc1",
"v3.1.0-rc0",
"v3.0.0-rc4",
"v3.0.0-rc3",
"v3.0.0-rc2",
"v3.0.0-rc1",
"v3.0.0-rc0",
"v2.12.0",
"v2.12.0-rc4",
"v2.12.0-rc3",
"v2.12.0-rc2",
"v2.12.0-rc1",
"v2.12.0-rc0",
"v2.11.0",
"v2.11.0-rc5",
"v2.11.0-rc4",
"v2.11.0-rc3",
"v2.11.0-rc2",
"v2.11.0-rc1",
"v2.11.0-rc0",
"v2.10.0",
"v2.10.0-rc4",
"v2.10.0-rc3",
"v2.10.0-rc2",
"v2.10.0-rc1",
"v2.9.0",
"v2.10.0-rc0",
"v2.9.0-rc5",
"v2.9.0-rc4",
"v2.9.0-rc3",
"v2.9.0-rc2",
"v2.9.0-rc1",
"v2.8.0",
"v2.9.0-rc0",
"v2.8.0-rc4",
"v2.8.0-rc3",
"v2.8.0-rc2",
"v2.8.0-rc1",
"v2.8.0-rc0",
"v2.7.0",
"v2.7.0-rc5",
"v2.7.0-rc4",
"v2.7.0-rc3",
"v2.7.0-rc2",
"v2.6.0",
"v2.7.0-rc1",
"v2.7.0-rc0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-11234.json"
}
}
],
"modified": "2026-10-28T02:30:41.451752659Z",
"provider": "osv",
"references": [
"https://access.redhat.com/downloads/content/package-browser/",
"https://access.redhat.com/errata/RHSA-2025:23228",
"https://access.redhat.com/errata/RHSA-2026:0326",
"https://access.redhat.com/errata/RHSA-2026:0332",
"https://access.redhat.com/errata/RHSA-2026:0702",
"https://access.redhat.com/errata/RHSA-2026:1831",
"https://access.redhat.com/errata/RHSA-2026:18772",
"https://access.redhat.com/errata/RHSA-2026:22147",
"https://access.redhat.com/errata/RHSA-2026:3077",
"https://access.redhat.com/errata/RHSA-2026:3165",
"https://access.redhat.com/errata/RHSA-2026:5578",
"https://access.redhat.com/errata/RHSA-2026:59831",
"https://access.redhat.com/errata/RHSA-2026:68513",
"https://access.redhat.com/errata/RHSA-2026:69131",
"https://access.redhat.com/security/cve/CVE-2025-11234",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11234.json",
"https://nvd.nist.gov/vuln/detail/CVE-2025-11234",
"https://bugzilla.redhat.com/show_bug.cgi?id=2401209",
"https://gitlab.com/qemu-project/qemu"
],
"provider_metadata": {
"cwe_ids": [
"CWE-416"
],
"cna_assigner": "redhat",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "18:10.0.0-14.el10_1.5"
},
{
"fixed": "8100020251120003312.489197e6"
},
{
"fixed": "8100020251202222937.489197e6"
},
{
"fixed": "8040020260916092751.522a0ee4"
},
{
"fixed": "8040020260916092751.522a0ee4"
},
{
"fixed": "8080020260910092120.63b34585"
},
{
"fixed": "8080020260910092120.63b34585"
},
{
"fixed": "17:10.1.0-17.el9_8"
},
{
"fixed": "17:6.2.0-11.el9_0.10"
},
{
"fixed": "17:7.2.0-14.el9_2.24"
},
{
"fixed": "17:8.2.0-11.el9_4.18"
},
{
"fixed": "17:8.2.0-11.el9_4.19"
},
{
"fixed": "412.86.202608241157-0"
},
{
"fixed": "416.94.202601071926-0"
},
{
"fixed": "417.94.202601120213-0"
},
{
"fixed": "418.94.202601071817-0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "InverseAffectedRanges"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11234.json"
}
},
"related_cves": [
{
"value": "CVE-2025-11234",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 509195,
"published_at": "2025-10-03T10:30:34.427+00:00"
}