CVE-2025-11234
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-416
Utilización después de liberación
Fecha de publicación:
03/10/2025
Última modificación:
17/12/2025
Descripción
*** Pendiente de traducción *** A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.
Impacto
Puntuación base 3.x
7.50
Gravedad 3.x
ALTA