CVE-2018-7550

The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access.

• CWE-125
• CWE-787

• http://www.securityfocus.com/bid/103181Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:1369Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2462Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1549798Issue Tracking, Vendor Advisory
• https://github.com/orangecertcc/security-research/security/advisories/GHSA-f49v-45qp-cv53
• https://lists.debian.org/debian-lts-announce/2018/04/msg00015.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/04/msg00016.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/09/msg00007.htmlMailing List, Third Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2018-02/msg06890.htmlMailing List, Patch
• https://usn.ubuntu.com/3649-1/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4213Third Party Advisory
• http://www.securityfocus.com/bid/103181Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:1369Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2462Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1549798Issue Tracking, Vendor Advisory
• https://github.com/orangecertcc/security-research/security/advisories/GHSA-f49v-45qp-cv53
• https://lists.debian.org/debian-lts-announce/2018/04/msg00015.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/04/msg00016.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/09/msg00007.htmlMailing List, Third Party Advisory
• https://lists.gnu.org/archive/html/qemu-devel/2018-02/msg06890.htmlMailing List, Patch
• https://usn.ubuntu.com/3649-1/Third Party Advisory
• https://www.debian.org/security/2018/dsa-4213Third Party Advisory

Published

Mar 1, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-7543Cross-site scripting (XSS) vulnerability in installer/build/…6.1
• CVE-2018-7544A cross-protocol scripting issue was discovered in the manag…
• CVE-2018-7546wpsmain.dll in Kingsoft WPS Office 2016 and Jinshan PDF 10.1…
• CVE-2018-7547lyadmin 1.x has XSS via the config[WEB_SITE_TITLE] parameter…4.8
• CVE-2018-7548In subst.c in zsh through 5.4.2, there is a NULL pointer der…
• CVE-2018-7549In params.c in zsh through 5.4.2, there is a crash during a …
• CVE-2018-7551There is an invalid free in MiniPS::delete0 in minips.cpp th…
• CVE-2018-7552There is an invalid free in Mapping::DoubleHash::clear in ma…
• CVE-2018-7553There is a heap-based buffer overflow in the pcxLoadRaster f…
• CVE-2018-7554There is an invalid free in ReadImage in input-bmp.ci that l…
• CVE-2018-7556LimeSurvey 2.6.x before 2.6.7, 2.7x.x before 2.73.1, and 3.x…
• CVE-2018-7557The decode_init function in libavcodec/utvideodec.c in FFmpe…6.5