CVE-2017-15124 - CVE House
Back to Database
Status published High CVE-2017-15124

VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older...

Vulnerability Description

VNC server implementation in Quick Emulator (QEMU) 2.11.0 and older was found to be vulnerable to an unbounded memory allocation issue, as it did not throttle the framebuffer updates sent to its client. If the client did not consume these updates, VNC server allocates growing memory to hold onto this data. A malicious remote VNC client could use this flaw to cause DoS to the server host.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-15124

Credits & Attribution

No credits recorded in the NVD database.

References

More from QEMU

View All →
CVE-2025-54567
hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit...
Medium 4.2
CVE-2025-54566
hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency,...
Medium 4.2
CVE-2017-7539
An assertion-failure flaw was found in Qemu before 2.10.1, in...
Medium 5.3
CVE-2017-7493
Quick Emulator (Qemu) built with the VirtFS, host directory sharing...
High 7.8
CVE-2017-2633
An out-of-bounds memory access issue was found in Quick Emulator...
Medium 5.4

Affected Vendor

Affected Software

Qemu
Vulnerable Versions:
2.11.0 and older

Timeline

Official Publish: January 9th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-770

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1562 Impair Defenses
Defense Evasion
T1046 Network Service Discovery
Discovery