CVE-2010-0297

CVE-2010-0297 describes a buffer overflow vulnerability in QEMU versions prior to 0.11.1, specifically within the usb_host_handle_control function in its USB passthrough handling. This flaw allows a malicious guest OS user to trigger a denial of service (crash or hang) in the guest, or potentially execute arbitrary code on the host OS, through a specially crafted USB packet. With a CVSS score of 7.2, it is considered highly severe, requiring local access but with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage, suggesting it is not widely targeted.