CVE-2026-63319: 
QEMU vulnerability analysis and mitigation

CVE-2026-63319 is a vulnerability in QEMU's usbredir implementation where a malicious usbredir peer can send an ep_info message that resets max_packet_size to 0 after bulk receiving has started, triggering an infinite loop and SIGFPE signals due to modulo/division-by-zero errors in bulk packet handling. The CVE is currently in Reserved status with limited public disclosure. Affected software is QEMU (specific version ranges not yet publicly confirmed). The vulnerability is estimated as Medium severity by Feedly's analysis (Feedly). A fix commit has been identified in the QEMU upstream repository (QEMU Commit).

The root cause is insufficient validation of the max_packet_size field in the ep_info message processed by QEMU's usbredir guest-to-host USB redirection subsystem. A malicious peer (e.g., a compromised or attacker-controlled USB redirection client/server) can send a crafted ep_info message mid-session — after bulk USB transfers have already begun — resetting max_packet_size to zero. Subsequent bulk packet handling code performs modulo or division operations using this value, resulting in a divide-by-zero condition (SIGFPE) and/or an infinite loop, classified under CWE-369 (Divide By Zero). The fix is available in the QEMU upstream commit a002485bfef184f04a58adfd2a848c19f583f7d0 (QEMU Commit).

Successful exploitation causes a denial of service (DoS) against the QEMU process handling USB redirection — either through an infinite loop consuming CPU resources or a SIGFPE crash terminating the QEMU instance. This would result in an availability impact for any virtual machine relying on the affected usbredir session. There is no currently confirmed confidentiality or integrity impact, and lateral movement potential appears limited to disruption of the virtualized environment (Feedly).

No public exploit code or in-the-wild exploitation has been reported for CVE-2026-63319 as of the latest available data. The CVE remains in Reserved status, and exploitation requires the attacker to control or compromise a usbredir peer (client or server) communicating with the vulnerable QEMU instance, limiting the attack surface. The vulnerability has been detected by Nessus plugin 330021 (Tenable). It is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no EPSS score has been published.

1. Establish usbredir session: The attacker must control a usbredir peer (e.g., act as a malicious USB redirection client or server) that has an active connection to a vulnerable QEMU instance with USB redirection enabled.
2. Initiate bulk transfer: Allow or trigger a bulk USB transfer to begin on the target endpoint, so that the QEMU bulk receiving code path is active.
3. Send malicious ep_info message: Craft and send an ep_info message to the QEMU usbredir handler with max_packet_size set to 0, targeting an already-active bulk endpoint.
4. Trigger divide-by-zero / infinite loop: QEMU's bulk packet handling code performs modulo or division using the now-zero max_packet_size, causing a SIGFPE crash or infinite loop, resulting in denial of service for the affected VM (QEMU Commit).

• Process: QEMU process terminating with SIGFPE (signal 8) or exhibiting 100% CPU usage attributed to an infinite loop in usbredir bulk packet handling.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing QEMU process crashes with Floating point exception or similar divide-by-zero messages.
• Network: Unexpected or malformed usbredir protocol messages on the usbredir TCP port (default 4719) from an untrusted peer, particularly ep_info messages sent after bulk transfer initiation.

Apply the upstream QEMU patch from commit a002485bfef184f04a58adfd2a848c19f583f7d0, which adds validation to prevent max_packet_size from being reset to zero after bulk receiving starts (QEMU Commit). Debian and other downstream distributions are tracking this via their security advisories (OSV/Debian). As a workaround, restrict usbredir access to trusted peers only and avoid exposing the usbredir port to untrusted networks. Monitor vendor package updates (e.g., Debian, Ubuntu, Red Hat) for backported fixes.