Qemu: vnc: null pointer dereference in qemu_clipboard_request()

6.5 CVSS

Vulnerability Description

A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reached before vnc_server_cut_text_caps() was called and had the chance to initialize the clipboard peer, leading to a NULL pointer dereference. This could allow a malicious authenticated VNC client to crash QEMU and trigger a denial of service.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-6683

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Red Hat would like to thank Fiona Ebner (Proxmox) and Markus Frank (Proxmox) for reporting this issue.

References

More from Red Hat

View All →

CVE-2025-9909

Aap-gateway: improper path validation in gateway allows credential exfiltration

Medium 6.7

CVE-2025-9908

Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams

Medium 6.7

CVE-2025-9907

Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda

Medium 6.7

CVE-2025-9901

Libsoup: improper handling of http vary header in libsoup caching

Medium 5.9

CVE-2025-9820

Gnutls: stack-based buffer overflow in gnutls_pkcs11_token_init() function

Medium 4

Affected Vendor

Red Hat

View all reports →

Affected Software

Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8 Advanced Virtualization

Vulnerable Versions:

8100020240314161907.e155f54d, 17:8.2.0-11.el9_4