A specially crafted VMDK image can trigger a heap buffer out-of-bounds read within QEMU’s vmdk compressed grain parsing logic, potentially leaking 12 bytes of sensitive memory content and, if the error propagates to the host, causing a denial of service by aborting the image import. The flaw is a classic Out‑of‑Bounds Read (CWE‑125).

The vulnerability affects QEMU binaries shipped with Red Hat products. Specifically, Red Hat Enterprise Linux release 6 through 10 and the Red Hat OpenShift Container Platform 4 are impacted as noted by the CNA. All hosts running these distributions with the vulnerable QEMU version remain at risk until a patched kernel module is installed.

The CVSS score of 5.1 places this vulnerability in the medium severity range. The EPSS value is below 1 %, indicating a very low probability of an in‑the‑wild exploit at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, so no public exploitation has been reported. The likely attack vector is inferred from the description: an attacker who can supply a malicious VMDK file to the host or a virtual machine using QEMU may trigger the read. If control over the input is possible, the attacker can read a small memory fragment or cause a host crash; however, the impact is limited to a brief data leak and possible instability rather than full system compromise.