CVE-2017-2615
CWE-787Published: July 3, 2018· Updated: Jun 17, 2026
Official Description
Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.
Technical Analysis
CVE-2017-2615 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.
Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.
From a weakness classification perspective (CWE-787): Out-of-bounds write vulnerabilities can lead to data corruption, crashes, or arbitrary code execution.
CVSS v3.1 Vector Breakdown
Affected Vendors & Products
Exploit & PoC Resources
Official Patches & Advisories
All References (42)
Quick Facts
Related CVEs (CWE-787)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2017-2615 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts