CVE-2026-5165

A flaw was found in virtio-win, specifically within the VirtIO Block (BLK) device. When the device undergoes a reset, it fails to properly manage memory, resulting in a use-after-free vulnerability. This issue could allow a local attacker to corrupt system memory, potentially leading to system instability or unexpected behavior.

Scoring

Severity

MEDIUM

CVSS base score

6.7

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS probability

0.11%

CWE

CWE-825

Published

2026-03-30

Last modified

2026-04-28

Weakness type

• CWE-825

Related vulnerabilities

• CVE-2026-77220 — PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting
• CVE-2026-76891 — Expired Pointer Dereference in Wireshark
• CVE-2026-76890 — Expired Pointer Dereference in Wireshark
• CVE-2026-17523 — can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet
• CVE-2026-10671 — User thread can re-initialize an in-use `k_pipe`, corrupting kernel wait queues (`CONFIG_USERSPACE`)
• CVE-2026-54778 — CoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
• CVE-2026-58592 — Ladybird - Web-Reachable Code Execution via Dangling FunctionType Reference in WebAssembly ESM Integration
• CVE-2026-12610 — Sssd: use-after-free crash in sssd' 'sssd_pam' process

Markdown version · Browse all CVEs