MajorCritical vulnerability

CVE-2026-81627 (CVSS 8.2)

NVD · officialPublished Sep 18, 2026Risk 37/100EPSS 0.2%

A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory.

Technical details

CVSS

8.2

AV:LocalAC:LowPR:HighUI:NoneC:HighI:HighA:High

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source