CVE-2022-3872

An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count == block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.

• CWE-193

• https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg01068.htmlMailing List, Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20221215-0005/Third Party Advisory
• https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg01068.htmlMailing List, Patch, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20221215-0005/Third Party Advisory

Published

Nov 7, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-38709IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 fo…6.1
• CVE-2022-38710IBM Robotic Process Automation 21.0.1 and 21.0.2 could discl…5.3
• CVE-2022-38712"IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web…5.9
• CVE-2022-38714IBM DataStage on Cloud Pak for Data 4.0.6 to 4.5.2 stores se…4.9
• CVE-2022-38715A leftover debug code vulnerability exists in the httpd shel…8.8
• CVE-2022-38716Cross-Site Request Forgery (CSRF) vulnerability in StylemixT…8.8
• CVE-2022-38723Gravitee API Management before 3.15.13 allows path traversal…8.6
• CVE-2022-38724Silverstripe silverstripe/framework through 4.11.0, silverst…5.4
• CVE-2022-38725An integer overflow in the RFC3164 parser in One Identity sy…7.5
• CVE-2022-3873Cross-site Scripting (XSS) - DOM in GitHub repository jgraph…6.1
• CVE-2022-38730Docker Desktop for Windows before 4.6 allows attackers to ov…6.3
• CVE-2022-38731Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory …4.3