CVE-2025-11234: Qemu-kvm: vnc websocket handshake use-after-free

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-03 · updated 2026-10-18
Weakness: CWE-416

Description

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.

Affected products

Red Hat OpenShift Container Platform 4.18: all versions — fixed in 418.94.202601071817-0
Red Hat Enterprise Linux 10: all versions — fixed in 18:10.0.0-14.el10_1.5
Red Hat Enterprise Linux 7: all versions
Red Hat Enterprise Linux 8: all versions — fixed in 8100020251120003312.489197e6, 8100020251202222937.489197e6
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support: all versions — fixed in 8040020260916092751.522a0ee4
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On: all versions — fixed in 8040020260916092751.522a0ee4
Red Hat Enterprise Linux 8.8 Telecommunications Update Service: all versions — fixed in 8080020260910092120.63b34585
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: all versions — fixed in 8080020260910092120.63b34585
Red Hat Enterprise Linux 9: all versions — fixed in 17:10.1.0-17.el9_8
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions: all versions — fixed in 17:6.2.0-11.el9_0.10
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions: all versions — fixed in 17:7.2.0-14.el9_2.24
Red Hat Enterprise Linux 9.4 Extended Update Support: all versions — fixed in 17:8.2.0-11.el9_4.18, 17:8.2.0-11.el9_4.19
Red Hat OpenShift Container Platform 4.12: all versions — fixed in 412.86.202608241157-0
Red Hat OpenShift Container Platform 4.16: all versions — fixed in 416.94.202601071926-0
Red Hat OpenShift Container Platform 4.17: all versions — fixed in 417.94.202601120213-0

How to fix

Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.18 418.94.202601071817-0; Red Hat Enterprise Linux 10 18:10.0.0-14.el10_1.5; Red Hat Enterprise Linux 8 8100020251120003312.489197e6, 8100020251202222937.489197e6; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020260916092751.522a0ee4; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 8040020260916092751.522a0ee4; Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020260910092120.63b34585; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020260910092120.63b34585; Red Hat Enterprise Linux 9 17:10.1.0-17.el9_8; Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions 17:6.2.0-11.el9_0.10; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 17:7.2.0-14.el9_2.24; Red Hat Enterprise Linux 9.4 Extended Update Support 17:8.2.0-11.el9_4.18, 17:8.2.0-11.el9_4.19; Red Hat OpenShift Container Platform 4.12 412.86.202608241157-0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-11234 or the next vulnerability affects your stack