CVE-2015-3456

CVE-2015-3456, known as VENOM, is an out-of-bounds write vulnerability in the Floppy Disk Controller (FDC) of QEMU, affecting virtualized environments like Xen and KVM. This flaw allows authenticated local guest users to trigger a denial of service or potentially execute arbitrary code on the host system. With a CVSS score of 7.7 (AV:A/AC:L/Au:S/C:C/I:C/A:C) and a FAUCET Risk Score of 97/100, its severity is high, indicating a network-adjacent attack with low complexity and significant impact on confidentiality, integrity, and availability. While not on the CISA KEV catalog, a Proof-of-Concept exploit is publicly available on ExploitDB, and the vulnerability garnered substantial media coverage and community discussion at the time of its disclosure.