Zero Radar
← feed
HighVulnerabilityupdated 26 Oct 2026, 08:02 UTC

QEMU flaw lets local attacker run code with user rights

Someone who already has a login on the computer could abuse a bug in QEMU, a virtualization tool, to run their own programs as your user account. From there they could bypass some security checks and read or change data.

Official source
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Local attackerAlready has a login or local process access
  2. 2QEMU bugVulnerable code in the virtualization tool
  3. 3Code executionRuns programs with user privileges
  4. 4Data at riskFiles and data can be changed or read
  5. ResultAttacker runs code as your user

What happened

A vulnerability in QEMU allows a local attacker to execute arbitrary program code with user privileges, bypassing security mechanisms. A separate, lower-rated BSI advisory describes the same class of code execution issue.

Why it is dangerous: An attacker who can run code as your user can reach your files, credentials and any virtual machines you manage, so data may be manipulated or disclosed. Systems where untrusted users or processes can access QEMU are most at risk.

Are you affected?

You are affected if you run a QEMU version without the vendor fix on a system where a local, possibly untrusted user or process can run commands.

What to do

  1. Check which QEMU version you run and whether it is listed in the BSI advisory
  2. Update QEMU to the latest version from your distribution or the QEMU project
  3. Limit local access to hosts running QEMU to trusted accounts only

Timeline

  1. 26 Oct 2026, 07:55 UTC
    Publicly disclosed
  2. 26 Oct 2026, 07:55 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  3. 26 Oct 2026, 07:55 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  4. 26 Oct 2026, 08:02 UTC
    Picked up by Zero Radar

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
ZR-0020c237 · ZR-a7ce5523
Disclosed
26 Oct 2026, 07:55 UTC
On Zero Radar
26 Oct 2026, 08:02 UTC (7 min after disclosure)
Last change
26 Oct 2026, 08:02 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

QEMU flaw lets local attacker run code with user rights · Zero Radar