An off‑by‑one error in QEMU’s handling of the Xen physdev hypercall kvm xen physdevop_map_pirq allows a malicious guest VM to trigger an out‑of‑bounds heap access in the QEMU process. This flaw can lead to service interruption or memory corruption, exposing the host system to downtime. The vulnerability is categorized as both an out‑of‑bounds read (CWE‑125) and write (CWE‑787), underscoring its impact on the integrity of the QEMU heap.

The affected platform is Red Hat Enterprise Linux across releases 6, 7, 8, 9, and 10, as well as Red Hat OpenShift Container Platform 4. All hosts running the default QEMU/KVM packages for these distributions are potentially impacted.

The CVSS base score of 6.5 denotes a medium severity assessment. EPSS indicates a very low probability of exploitation (< 1 %). The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting no publicly known exploits yet. The likely attack vector involves a malicious guest that issues a crafted Xen physdev hypercall; the attacker must have the ability to run a virtual machine on the host, making this a local‑escalation style threat in a multi‑tenant or virtualized environment.