HOMEVULNERABILITIESCVE-2016-2538
HIGH

CVE-2016-2538

CWE-189Published: June 16, 2016· Updated: Jun 17, 2026

7.1
CVSS v3.1

Official Description

Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to cause a denial of service (QEMU process crash) or obtain sensitive host memory information via a remote NDIS control message packet that is mishandled in the (1) rndis_query_response, (2) rndis_set_response, or (3) usb_net_handle_dataout function.

NVD Source

Technical Analysis

CVE-2016-2538 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), availability disruption (denial of service), with a CVSS base score of 7.1.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorLocal
Attack ComplexityLow
Privileges Req.Low
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityNone
AvailabilityHigh
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Affected Vendors & Products

qemu1 product(s)
qemu
Source: NVD CPE · 1 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
External links open in a new tab. Always verify in a controlled environment before use.

All References (18)

Quick Facts

CVE IDCVE-2016-2538
CVSS Score7.1 / 10
SeverityHIGH
WeaknessCWE-189
CISA KEVNo
Affected1 vendor(s)
PublishedJun 16, 2016

Related CVEs (CWE-189)

Recommended Actions

  • Apply vendor patches immediately
  • Monitor CVE-2016-2538 in threat intel feeds
  • Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.