CVE-2019-12928

CVE-2019-12928 describes an OS command injection vulnerability in the QMP migrate command of QEMU version 4.0.0 and earlier, potentially allowing remote attackers to achieve code execution, denial of service, or information disclosure. This critical vulnerability, rated 9.8 CVSS, can be exploited remotely with low attack complexity, leading to high impacts on confidentiality, integrity, and availability. While not listed in CISA KEV, a Metasploit module exists for exploitation, though there is no evidence of active exploitation or significant community discussion.