A critical use-after-free vulnerability in QEMU allows unauthenticated remote attackers to cause a denial of service condition via the VNC WebSocket interface.

This flaw exists in the QIOChannelWebsock object, where a GSource is leaked if the object is freed during a handshake. An unauthenticated attacker can exploit this via network access to the VNC WebSocket port to trigger a use-after-free condition.

Successful exploitation results in a denial of service, rendering the affected QEMU instance unavailable. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to service availability and operational continuity, particularly for virtualized environments relying on VNC for remote management.

Immediate Action: Update QEMU to the patched versions provided by your Linux distribution, such as those specified in the Red Hat advisories (RHSA-2025:23228 and subsequent updates).

Proactive Monitoring: Monitor system logs for repeated VNC connection failures or unexpected process crashes that may indicate an attempt to trigger the use-after-free condition.

Compensating Controls: Restrict network access to the VNC WebSocket port to trusted management subnets using host-based firewalls or network access control lists to prevent unauthenticated access.

Public Exploit Available: Unknown

The risk of service disruption necessitates immediate attention. Administrators must prioritize patching QEMU across all virtualization hosts to eliminate this vulnerability, as the lack of authentication requirements makes the service an attractive target for remote attackers seeking to cause system instability.