{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"qemu","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NTEK5VT02MX2313RYFSXT5","modified_at":"2026-10-15T00:00:07.436657048Z","published_at":"2026-08-10T22:17:10.027Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-6426","https://security-tracker.debian.org/tracker/CVE-2026-6426"],"severity":{"label":"medium","score":4.4},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-6426","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-6426"}],"summary":"A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32"}