QEMU VGA text: out-of-bounds write
CVE-2026-77913
Public research by Warisjeet Singh sin99xx
Disclosed
The public finding
What was found.
The text and graphics renderers share one geometry cache in different units. Switching modes can leave the resize check comparing equal values, and the glyph loop paints past the surface. Our follow-up patch is merged upstream.
Sources and evidence.
The evidence: hw/display/vga.c, verbatim
qemu / hw/display/vga.c · commit 418396be
merged 2026-08-25
@@ -1249,8 +1252,8 @@ static void vga_draw_text(VGACommonState *s, int full_update) surface = qemu_console_surface(s->con); qemu_console_text_resize(s->con, width, height); s->last_depth = 0; - s->last_width = width; - s->last_height = height; + s->last_text_width = width; + s->last_text_height = height; s->last_ch = cheight;