Use-After-Free Vulnerability in QEMU Affecting VNC WebSocket Connections

CVE-2025-11234

What is CVE-2025-11234?

A vulnerability exists within the QIOChannelWebsock object in QEMU, which can be exploited if this object is freed while awaiting a handshake completion. This situation leads to a GSource object being leaked, potentially allowing a malicious client with network access to the VNC WebSocket port to trigger a denial of service. This occurs during the handshake phase prior to the authentication of the VNC client, posing a risk to users relying on VNC services.

References