QEMU · VGA

QEMU VGA text: out-of-bounds write

Identifier: CVE-2026-77913
Disclosed: 2026-08-24
Merged: 2026-08-25
Credit: Warisjeet Singh

The text and graphics renderers share one geometry cache in different units. Switching modes can leave the resize check comparing equal values, and the glyph loop paints past the surface. Our follow-up patch is merged upstream.

Exhibit 01The evidence: hw/display/vga.c, verbatim

qemu / hw/display/vga.c · commit 418396bemerged 2026-08-25

@@ -1249,8 +1252,8 @@ static void vga_draw_text(VGACommonState *s, int full_update)
         surface = qemu_console_surface(s->con);
         qemu_console_text_resize(s->con, width, height);
         s->last_depth = 0;
-        s->last_width = width;
-        s->last_height = height;
+        s->last_text_width = width;
+        s->last_text_height = height;
         s->last_ch = cheight;