CVE-2021-3544

Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime.

• CWE-401
• CWE-401

• http://www.openwall.com/lists/oss-security/2021/05/31/1Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1958935Issue Tracking
• https://security.gentoo.org/glsa/202208-27Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210720-0008/Third Party Advisory
• https://www.debian.org/security/2021/dsa-4980Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/05/31/1Mailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1958935Issue Tracking
• https://security.gentoo.org/glsa/202208-27Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210720-0008/Third Party Advisory
• https://www.debian.org/security/2021/dsa-4980Third Party Advisory

Published

Jun 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35414Chamilo LMS v1.11.x was discovered to contain a SQL injectio…9.8
• CVE-2021-35415A stored cross-site scripting (XSS) vulnerability allows att…4.8
• CVE-2021-3542Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-3543A flaw null pointer dereference in the Nitro Enclaves kernel…6.7
• CVE-2021-35437SQL injection vulnerability in LMXCMS v.1.4 allows attacker …9.8
• CVE-2021-35438phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets…6.1
• CVE-2021-35440Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). …6.1
• CVE-2021-35448Emote Interactive Remote Mouse 3.008 on Windows allows attac…7.8
• CVE-2021-35449The Lexmark Universal Print Driver version 2.15.1.0 and belo…7.8
• CVE-2021-3545An information disclosure vulnerability was found in the vir…6.5
• CVE-2021-35450A Server Side Template Injection in the Entando Admin Consol…7.2
• CVE-2021-35451In Teradici PCoIP Management Console-Enterprise 20.07.0, an …6.1