CVE-2026-5165 identifies a use-after-free vulnerability in the VirtIO Block (BLK) device within virtio-win, stemming from improper memory management during device resets. Rated Medium (CVSS 6.7), exploitation requires local access and high privileges (AV:L/PR:H) and could lead to system memory corruption, resulting in high impact to confidentiality, integrity, and availability. There is no evidence of active exploitation, and public exploit code is not available in Metasploit, Nuclei, or ExploitDB. Community discussion is minimal with only one mention, and the vulnerability is not listed on the CISA KEV catalog or Hot List.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:redhat:virtio-win:-:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.