Skip to content
Heist/ feed
Back to feed
Low

Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callback

Type: advisorySources: OSV

A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is invoked. The function allocates a heap buffer without zeroing the memory, leaving the buffer filled with residual data from prior allocations. When the guest later reads from register UEFI_VARS_REG_PIO_BUFFER_TRANSFER, the .read callback `uefi_vars_read` returns leftover metadata or other sensitive process memory from the previously allocated buffer, leading to an information disclosure vulnerability.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-8860
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 13:07 UTC · Revision 1

Source evidence

Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callback

core-osv · Original source

Published 18 Feb 2026, 20:49 UTC

A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is invoked. The function allocates a heap buffer without zeroing the memory, leaving the buffer filled with residual data from prior allocations. When the guest later reads from register UEFI_VARS_REG_PIO_BUFFER_TRANSFER, the .read callback `uefi_vars_read` returns leftover metadata or other sensitive process memory from the previously allocated buffer, leading to an information disclosure vulnerability.

osv:CVE-2025-8860
Complete source record
{
  "id": "d96f44c4949b765cd5f2d28e39bf8af4d27697e38936daf8461be33c4b309200",
  "url": "https://osv.dev/vulnerability/CVE-2025-8860",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Qemu-kvm: uefi-vars: information disclosure vulnerability in uefi_vars_write callback",
    "summary": "A flaw was found in QEMU in the uefi-vars virtual device. When the guest writes to register UEFI_VARS_REG_BUFFER_SIZE, the .write callback `uefi_vars_write` is invoked. The function allocates a heap buffer without zeroing the memory, leaving the buffer filled with residual data from prior allocations. When the guest later reads from register UEFI_VARS_REG_PIO_BUFFER_TRANSFER, the .read callback `uefi_vars_read` returns leftover metadata or other sensitive process memory from the previously allocated buffer, leading to an information disclosure vulnerability.",
    "evidence": "osv:CVE-2025-8860",
    "products": [],
    "severity": "low",
    "structured": {
      "id": "CVE-2025-8860",
      "aliases": [
        "CVE-2025-8860"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://gitlab.com/qemu-project/qemu",
              "type": "GIT",
              "events": [
                {
                  "introduced": "7c949c53e936aa3a658d84ab53bae5cadaa5d59c"
                },
                {
                  "fixed": "f8b2f64e2336a28bf0d50b6ef8a7d8c013e9bcf3"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "10.0.0"
                      },
                      {
                        "fixed": "10.1.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v10.1.0-rc4",
            "v10.1.0-rc3",
            "v10.1.0-rc2",
            "v10.1.0-rc1",
            "v10.1.0-rc0",
            "v10.0.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8860.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:29.180857333Z",
      "provider": "osv",
      "references": [
        "https://access.redhat.com/downloads/content/package-browser/",
        "https://access.redhat.com/security/cve/CVE-2025-8860",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8860.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-8860",
        "https://bugzilla.redhat.com/show_bug.cgi?id=2387588",
        "https://gitlab.com/qemu-project/qemu"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-212"
        ],
        "cna_assigner": "fedora",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8860.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-8860",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 495663,
  "published_at": "2026-02-18T20:49:06.186+00:00"
}