Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-5088

21
FAUCET Score

CVE-2023-5088 describes a critical bug in QEMU that could allow a malicious guest VM to overwrite the boot code of its host hypervisor (L1) by redirecting I/O operations to offset 0 of the host's virtual disk. This vulnerability, affecting QEMU and Red Hat Enterprise Linux, carries a CVSS score of 7.0 (HIGH) due to its low attack complexity and high potential for confidentiality, integrity, and availability impact. While there is no known active exploitation or public exploit code, the vulnerability has garnered some community attention and media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
< 8.2.0CPE matchmatch criteria
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*
8.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
8.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:advanced_virtualization:*:*:*
9.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

6.4MEDIUM

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
0.5
Impact Score
5.9
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.23%
Probability of exploitation in next 30 days
EPSS Percentile
14.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0023 is in the 41st percentile among its peer group of 1,525 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.4 InfoSec Media, 0.1 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (14)

microsoftpatch availablevia msrc
Product: cbl2 qemu 6.2.0-21 on CBL Mariner 2.0Fixed in: 6.2.0-21
microsoftpatch availablevia msrc
Product: cbl2 qemu 6.2.0-24 on CBL Mariner 2.0Fixed in: 6.2.0-21
microsoftpatch availablevia msrc
Product: 17093-17086Fixed in: 6.2.0-21
microsoftpatch availablevia msrc
Product: 19662-17086Fixed in: 6.2.0-21
microsoftpatch availablevia msrc
Product: 18121-16823Fixed in: 6.2.0-21
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: qemu-kvm-17:8.2.0-11.el9_4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: virt-devel:rhel-8100020240314161907.e155f54d
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: virt:rhel-8100020240314161907.e155f54d
View patch
redhatpatch availablevia nvd_reference
View patch
ubuntupatch availablevia ubuntu_usn
Product: qemu (xenial)Fixed in: 1:2.5+dfsg-5ubuntu10.51+esm4
ubuntupatch availablevia ubuntu_usn
Product: qemu (trusty)Fixed in: 2.0.0+dfsg-2ubuntu1.47+esm6
ubuntupatch availablevia ubuntu_usn
Product: qemu (focal)Fixed in: 1:4.2-3ubuntu6.30+esm1
ubuntupatch availablevia ubuntu_usn
Product: qemu (bionic)Fixed in: 1:2.11+dfsg-1ubuntu7.42+esm5
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 8 Advanced VirtualizationFixed in: virt:av/qemu-kvm

Vendor Advisories (3)

ubuntuUSN-8412-1

QEMU vulnerabilities

Jun 9, 2026
microsoft2023-Nov/CVE-2023-5088

Qemu: improper ide controller reset can lead to mbr overwrite

Nov 14, 2023
redhatCVE-2023-5088Moderate

QEMU: improper IDE controller reset can lead to MBR overwrite

Sep 21, 2023

References

lists.debian.org / debian-lts-announce/2024/03/msg00012.html
lists.debian.org / debian-lts-announce/2025/04/msg00042.html
security.netapp.com / advisory/ntap-20231208-0005
access.redhat.com / errata/RHSA-2024:2135
access.redhat.com / errata/RHSA-2024:2962
access.redhat.com / security/cve/CVE-2023-5088
Third Party Advisory
bugzilla.redhat.com / show_bug.cgi
Issue TrackingPatch
lore.kernel.org / all/[email protected]/T
Mailing ListPatch