NVD / CVE Program· CNA redhat

CVE-2021-20203: An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0.

LowCVSS 3.2 · v3.1—No exploit Fix available

Noroxi assessment

Priority: Monitor (action score 12/100)

The sources we track (CISA KEV, Exploit-DB, Metasploit, Nuclei, GitHub) show no public exploit code or exploitation in the wild.
Probability of exploitation in the next 30 days: 0.59% (FIRST EPSS).
Someone with local access to the system can trigger it. Administrator privileges are required. No user action is required. No special conditions are required; it is repeatable.
Fixed version: qemu (Alpine:v3.15) 6.1.1-r0; qemu (Alpine:v3.16) 5.2.0-r0; qemu (Debian:10) 1:3.1+dfsg-8+deb10u9.
Mentioned 1 time in Turkish national cyber security advisories (siberguvenlik.gov.tr).

Low priority for now. Upgrade to qemu (Alpine:v3.15) 6.1.1-r0; qemu (Alpine:v3.16) 5.2.0-r0; qemu (Debian:10) 1:3.1+dfsg-8+deb10u9 or later.

Generated automatically from the record's data: CVSS (NVD and CNA), CISA KEV and SSVC, FIRST EPSS, exploit sources, fixed versions. How we calculate it

Primary sources: NVD · CVE.org · FIRST EPSS

An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.

Published: Feb 25, 2021
Updated: Jun 16, 2026
EPSS: 0.5% · 48th percentile
CWE: CWE-190

Report tools

JSON

Action score

Monitor

Low priority for now.

CVSS: 12 / 40 · 3.2 / 10
CISA KEV: 0 / 30 · Not listed
EPSS: 0 / 30 · 0.5%

Get told when this record changes

Not in KEV: no record of exploitation in the wild
No public exploit code on record
A fix has been released

If any of these changes, we'll tell you in the daily email digest.

Is your version affected? Check it

Noroxi analysis

What does it mean in your environment?

The assessment above is generated automatically from the record's data; it doesn't know your environment. Our team verifies on your systems whether this vulnerability is actually exploitable and which mitigation is enough.

We use this product, ask for help

Affected systems

Is your version affected?

Pick the product and type the version you run. It's compared with this record's version ranges in your browser; the version isn't sent anywhere.

Vendor	Product	CPE
qemu	qemu	cpe:2.3:a:qemu:qemu
fedoraproject	fedora	cpe:2.3:o:fedoraproject:fedora
debian	debian linux	cpe:2.3:o:debian:debian_linux

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

n/a qemu
- versions up to v5.2.0affected

Affected versions · NVD (4)

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

debian debian linux10.0
debian debian linux9.0
fedoraproject fedora33
qemu qemuup to 5.2.0 inclusive

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Ecosystem	Package	Affected range	Fix
Alpine:v3.15	qemu	before 6.1.1-r0	6.1.1-r0
Alpine:v3.16	qemu	before 5.2.0-r0	5.2.0-r0
Debian:10	qemu	before 1:3.1+dfsg-8+deb10u9	1:3.1+dfsg-8+deb10u9
Debian:12	qemu	before 1:6.2+dfsg-1	1:6.2+dfsg-1
Debian:9	qemu	before 1:2.8+dfsg-6+deb9u14	1:2.8+dfsg-6+deb9u14
openSUSE:Leap 15.2	qemu	before 4.2.1-lp152.9.9.2	4.2.1-lp152.9.9.2
openSUSE:Leap 15.2	qemu-linux-user	before 4.2.1-lp152.9.9.3	4.2.1-lp152.9.9.3
openSUSE:Leap 15.2	qemu-testsuite	before 4.2.1-lp152.9.9.5	4.2.1-lp152.9.9.5
SUSE:HPE Helion OpenStack 8	qemu	before 2.9.1-6.47.1	2.9.1-6.47.1
SUSE:Linux Enterprise Module for Basesystem 15 SP2	qemu	before 4.2.1-11.13.1	4.2.1-11.13.1
SUSE:Linux Enterprise Server 12 SP2-BCL	qemu	before 2.6.2-41.62.1	2.6.2-41.62.1
SUSE:Linux Enterprise Server 12 SP5	qemu	before 3.1.1.1-48.2	3.1.1.1-48.2

Same product

qemu: all records

Other highest-scoring records for the same primary product.

CVE-2019-12928The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to…
60This week
CVE-2015-8556Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.
44Plan
CVE-2017-15118A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an…
43Plan

Published before and after this one in the same product

← EarlierCVE-2020-35517Jan 28, 2021 · A flaw was found in qemu.
32Monitor
← EarlierCVE-2020-17380Jan 30, 2021 · A heap-based buffer overflow was found in QEMU through 5.0.0 in the SDHCI device emulation support.
25Monitor
Later →CVE-2021-20263Mar 9, 2021 · A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU.
13Monitor

Remediation

Which version to upgrade to

Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.

Product / package	Fixed version	Source
alpine:qemu	6.1.1-r0 · Alpine:v3.15	Package registry (OSV)
debian:qemu	1:6.2+dfsg-1 · Debian:12	Package registry (OSV)
opensuse:qemu	4.2.1-lp152.9.9.2 · openSUSE:Leap 15.2	Package registry (OSV)
opensuse:qemu-linux-user	4.2.1-lp152.9.9.3 · openSUSE:Leap 15.2	Package registry (OSV)
opensuse:qemu-testsuite	4.2.1-lp152.9.9.5 · openSUSE:Leap 15.2	Package registry (OSV)
suse:qemu	4.2.1-11.13.1 · SUSE:Linux Enterprise Module for Basesystem 15 SP2	Package registry (OSV)

Exploit status

No known public exploit

No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.

Research context

For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.