A vulnerability in QEMU’s VAPIC setup hypercall allows a privileged guest to position a writable RAM alias outside the intended option‑ROM window, overwriting locked System Management Mode RAM. The injected code runs with full System Management Mode privileges, giving the attacker complete control over the host system. The weakness is a classic buffer‑overrun/validation issue (CWE‑787), permitting unauthorized memory writes that compromise system integrity and confidentiality.

Red Hat Enterprise Linux 10, 6, 7, 8, 9, Red Hat Enterprise Linux for NVIDIA 26, Red Hat OpenShift Container Platform 4, and Red Hat OpenStack Platform 13 (Queens) that rely on QEMU for virtual machine execution. No specific version numbers are listed, so all installations using the affected QEMU build should be considered vulnerable.

The CVSS score of 8.2 indicates high severity; the EPSS score of < 1% indicates a very low exploitation probability and the vulnerability is not in the CISA KEV catalog, suggesting no publicly known exploits yet. The attack requires a privileged guest on a Q35/KVM machine, implying that the attacker must run a virtual machine with elevated rights on the host. While the exploit path is not trivial, the potential impact of escaping SMRAM means that the risk is significant for environments that grant VM hypervisor privileges.