CVE-2025-8860
Information Disclosure in QEMU uefi-vars Due to Uninitialized Buffer
Publication date: 2026-02-18
Last updated on: 2026-02-18
Assigner: Fedora Project
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| qemu | qemu | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-212 | The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-8860 is an information disclosure vulnerability in the QEMU-KVM component related to UEFI variable handling.
When a guest writes to the UEFI_VARS_REG_BUFFER_SIZE register, the `uefi_vars_write` callback function allocates a heap buffer but does not zero out the memory. This leaves the buffer filled with residual data from previous allocations.
Later, when the guest reads from the UEFI_VARS_REG_PIO_BUFFER_TRANSFER register, the `uefi_vars_read` callback returns this leftover data, which may include sensitive metadata or other process memory contents.
This results in an information disclosure vulnerability, potentially exposing sensitive information from the host or other processes.
How can this vulnerability impact me? :
This vulnerability can lead to unintended information disclosure.
Specifically, sensitive metadata or other process memory from previous allocations may be exposed to a guest virtual machine running on QEMU-KVM with UEFI variable support.
An attacker with access to the guest could potentially read sensitive information from the host or other processes, which could be leveraged for further attacks or data breaches.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update QEMU-KVM to a version that includes the upstream fix which ensures proper memory initialization during buffer allocation.
This fix prevents the information disclosure by zeroing out the heap buffer before use, eliminating residual data exposure.
Ensure your Linux operating system running QEMU-KVM with UEFI variable support is patched accordingly.