Search/CVE-2026-5164
● CVE — Medium

CVE-2026-5164

VendorredhatProductenterprise linux, virtio-winDiscoveredMar 30, 2026UpdatedApr 28, 2026

A flaw was found in virtio-win. The RhelDoUnMap() function does not properly validate the number of descriptors provided by a user during an unmap request. A local user could exploit this input validation vulnerability by supplying an excessive number of descriptors, leading to a buffer overrun. This can cause a system crash, resulting in a Denial of Service (DoS).

CVSS v3.1
6.7 MEDIUM
EPSS
0.16%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
CVSS v3.1 Detail
Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredHIGH
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Connections
3 relationships
Timeline
disclosure → media coverage
Mar 30, 2026
Disclosure — published as a CVE record. · last revised by NVD Apr 28, 2026