Read the docs
TI-2017-03873 Aliases CVE-2017-5957GHSA-97qh-pwfw-7gj4

Stack-based buffer overflow in the vrend_decode_set_framebuffer_state function in…

Priority LOW 25CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Stack-based buffer overflow in the vrend_decode_set_framebuffer_state function in vrend_decode.c in virglrenderer before 926b9b3460a48f6454d8bbe9e44313d86a65447f, as used in Quick Emulator (QEMU), allows a local guest users to cause a denial of service (application crash) via the "nr_cbufs" argument.

Why it matters now

EPSS 0.0039 33rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:virglrenderer_project:virglrenderer:*:*:*:*:*:*:*:*before 0.6.0VulnerableVirglrenderer Project
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*all versionsRunning onQEMU
  • cpe:2.3:a:virglrenderer_project:virglrenderer:*:*:*:*:*:*:*:* Versions before 0.6.0 Vulnerable ·Virglrenderer Project
  • cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* Versions all versions Running on ·QEMU

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-5957
  2. 2026-10-03 Alias added: GHSA-97qh-pwfw-7gj4

References

Patch 3

Advisory 1

  • TI-2022-00078 Out-of-bounds write in virglrenderer CVSS 3.1HIGH 7.8
  • TI-2019-13392 A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in… CVSS 3.1HIGH 7.8
  • TI-2017-03585 The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c in virglrenderer… CVSS 3.0HIGH 7.1
  • TI-2019-13393 An out-of-bounds read in the vrend_blit_need_swizzle function in vrend_renderer.c in… CVSS 3.1HIGH 7.1
  • TI-2017-04195 Memory leak in the vrend_create_vertex_elements_state function in vrend_renderer.c in… CVSS 3.1MEDIUM 6.5
  • TI-2017-04149 Memory leak in the add_shader_program function in vrend_renderer.c in virglrenderer… CVSS 3.0MEDIUM 6.5
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences