Vulnerability Report

CVE-2026-93834

RCE

Title: Use-after-free in QEMU 9pfs leading to VM escape

Use-After-Free / RCE / VM Escape

Proof Of Concept

PoC Available for CVE-2026-93834

CWE Category CWE-416
Published Date Sep 25, 2026
Modified Date Sep 25, 2026
Exploit Status Available
Score 8.8 CVSS v3.1
Exploit Probability (EPSS)
0.00%

Vulnerability Summary

CVE-2026-93834: A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user.

Impacted Vendors

Analysis in Progress...

Reference Links

https://access.redhat.com/security/cve/CVE-2026-93834 https://bugzilla.redhat.com/show_bug.cgi?id=2537939 https://gitlab.com/qemu-project/qemu/-/work_items/4491 https://gitlab.com/qemu-project/qemu/-/work_items/4491
CVSS v3.1
Source Entity [email protected]
Severity HIGH
8.8
Attack Vector
LOCAL
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
CHANGED
RAW VECTOR CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2026-93834 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/suominen/CVE-2026-93834
View Code
MODIFIED

Vulnerability data updated via NVD.

Attack Vector Matrix

Access Vector LOCAL
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Stack

No specific products linked.