On 7/6/26 15:53, Marc-André Lureau wrote:
vnc_refresh_lossy_rect() always marks a full VNC_STAT_RECT (64) rows as dirty when refreshing a lossy tile. When the display height is not a multiple of VNC_STAT_RECT (e.g. VNC_MAX_HEIGHT = 2160), the bottom tile is partial -- the last tile at y=2112 has only 48 valid rows. The unclamped loop writes to vs->dirty[2160..2175], past the end of the VNC_MAX_HEIGHT-sized array.Clamp the row count to the actual surface height so partial bottom tiles only mark valid dirty bitmap entries. Fixes: CVE-2026-48002 Fixes: 7d964c9d2fc6 ("vnc: refresh lossy rect after a given timeout") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3950 Reported-by: huntr bubble Signed-off-by: Marc-Andre Lureau <[email protected]>
This patch has already been merged to the qemu master branch (as commit 3543c2b855c), but it seems it's important to mention still. There already was a fix for CVE-2026-48002 earlier: commit 46ee49034d26d04d95ba8f3183d4fbfa9d2b89b4 Author: Daniel P. Berrangé <[email protected]> Date: Thu May 21 11:33:52 2026 +0100 ui/vnc: fix OOB write in lossy rect worker code which touched the same code. Now this one, with a very similar subject. Unfortunately this (additional) fix does not mention the previous fix, so there's some confusion about which commit actually fixed this issue. It looks like the first fix was incomplete and this additional fix were needed. Thanks, /mjt
