Qemu-kvm: vnc websocket handshake use-after-free

Summary

CVE	CVE-2025-11234
State	PUBLISHED
Assigner	redhat
Source Priority	CVE Program / NVD first with legacy fallback
Published	2025-10-03 11:15:30 UTC
Updated	2026-06-01 04:16:17 UTC
Description	A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.

Primary CVSS: v3.1 7.5 HIGH from [email protected]

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.001450000 probability, percentile 0.344760000 (date 2026-06-03)

Problem Types: CWE-416 | CWE-416 Use After Free

Version	Source	Type	Score	Severity	Vector
3.1	[email protected]	Secondary	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
3.1	CNA	CVSS	7.5	HIGH	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source	Vendor	Product	Version	Platforms
CNA	Red Hat	Red Hat Enterprise Linux 10	unaffected 18:10.0.0-14.el10_1.5 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8	unaffected 8100020251120003312.489197e6 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 8	unaffected 8100020251202222937.489197e6 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 9	unaffected 17:10.1.0-17.el9_8 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 9.0 Update Services For SAP Solutions	unaffected 17:6.2.0-11.el9_0.10 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions	unaffected 17:7.2.0-14.el9_2.24 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	unaffected 17:8.2.0-11.el9_4.18 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support	unaffected 17:8.2.0-11.el9_4.19 * rpm	Not specified
CNA	Red Hat	Red Hat OpenShift Container Platform 4.16	unaffected 416.94.202601071926-0 * rpm	Not specified
CNA	Red Hat	Red Hat OpenShift Container Platform 4.17	unaffected 417.94.202601120213-0 * rpm	Not specified
CNA	Red Hat	Red Hat OpenShift Container Platform 4.18	unaffected 418.94.202601071817-0 * rpm	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 6	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 7	Not specified	Not specified
CNA	Red Hat	Red Hat Enterprise Linux 7	Not specified	Not specified

Reference	Source	Link	Tags
bugzilla.redhat.com/show_bug.cgi	[email protected]	bugzilla.redhat.com
access.redhat.com/errata/RHSA-2026:22147	[email protected]	access.redhat.com
access.redhat.com/errata/RHSA-2026:0702	[email protected]	access.redhat.com
access.redhat.com/errata/RHSA-2026:3077	[email protected]	access.redhat.com
access.redhat.com/errata/RHSA-2026:3165	[email protected]	access.redhat.com
access.redhat.com/security/cve/CVE-2025-11234	[email protected]	access.redhat.com
access.redhat.com/errata/RHSA-2026:18772	[email protected]	access.redhat.com
access.redhat.com/errata/RHSA-2026:0332	[email protected]	access.redhat.com
access.redhat.com/errata/RHSA-2026:1831	[email protected]	access.redhat.com
access.redhat.com/errata/RHSA-2025:23228	[email protected]	access.redhat.com
access.redhat.com/errata/RHSA-2026:5578	[email protected]	access.redhat.com
access.redhat.com/errata/RHSA-2026:0326	[email protected]	access.redhat.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

CNA: Red Hat would like to thank Grant Millar (Cylo) for reporting this issue. (en)

Source	Time	Event
CNA	2025-09-30T00:00:00.000Z	Reported to Red Hat.
CNA	2025-09-30T12:18:00.000Z	Made public.

There are currently no legacy QID mappings associated with this CVE.