Imported by the "Security Issuer Importer" bot, on behalf of the original reporter who disclosed via qemu-security list: * From: `boy juju <agx1657748706@gmail.com>` * Date: `18 May, 2026` * Message ID: `<CAJUmCq5T7EdWRjdwdf+foME84__jXMDpJjR2iKR2ek+OAJy8zQ@mail.gmail.com>` **NOTE:** the original reporter can not be copied on this issue so cannot view this ticket while it remains marked confidential. If further information is needed about the disclosure, contact the reporter directly. ---- I would like to report a potential security issue in QEMU's incoming migration / vmstate deserialization path for uefi variable state. Automated discovery declaration: This issue was discovered with fuzzing assistance and then manually triaged and validated. I believe this issue may be security-relevant because a malicious migration source can trigger a heap out-of-bounds read in the destination QEMU process after migration completes, when migrated uefi variable state is serialized to JSON. If you confirm that this falls within QEMU's security policy, please assign a CVE and handle it under coordinated disclosure. Affected area: migration / vmstate deserialization uefi-vars-x64 device state loading post-load JSON persistence path Affected version tested: qemu-11.0.0-rc4 Impact summary: A crafted migration stream can cause the destination QEMU process to read beyond the end of a migrated variable-name buffer when uefi_vars_post_load() triggers JSON persistence. In my testing this is reproducible as an ASan-detected heap-buffer-overflow read in uefi_ucs2_to_ascii(). Root cause summary: The migrated variable name is later treated as a UCS-2 buffer, but the restore path does not reject odd-sized name_size values. As a result, a buffer that is only 1 byte long can still be read as if it contained a uint16_t element. The critical sequence is: 1. Migration restores a variable with a crafted odd name_size value. 2. uefi_vars_post_load() triggers uefi_vars_json_save(). 3. uefi_ucs2_to_ascii(var->name, var->name_size) processes the buffer. 4. Its loop condition permits a 2-byte read when only 1 byte is available. Code locations involved: - hw/uefi/var-service-core.c: uefi_vars_post_load() - hw/uefi/var-service-json.c: uefi_vars_json_save() - hw/uefi/var-service-utils.c: uefi_ucs2_to_ascii() Reproducer: I attached a minimal incoming migration sample and a simple reproducer script. The reproducer starts a destination instance with a crafted migration file and allows the post-load JSON save path to execute. Observed result: AddressSanitizer reports a heap-buffer-overflow read in uefi_ucs2_to_ascii(), reached through uefi_vars_to_qapi() and uefi_vars_json_save(). Example ASan symptom: ERROR: AddressSanitizer: heap-buffer-overflow in uefi_ucs2_to_ascii(...) in uefi_vars_to_qapi(...) in uefi_vars_json_save(...) Attack scenario: A malicious or compromised migration source can send a crafted migration stream to a destination QEMU process that accepts incoming migration and persists uefi variable state to JSON, causing an out-of-bounds read after state loading. Disclosure status: This issue is not public to the best of my knowledge. Suggested fix direction: Odd-sized UCS-2 name buffers should be rejected before they reach the JSON save path, or the conversion routine should verify that a full 2-byte element remains available before reading it. Attachments: - repro.sh - uefi_var_name_odd_oob_read.mig - repro.log - uefi_vars_out.json Please let me know if you would like me to provide: - the full ASan log, - a minimized test case in a different format, - or a proposed patch. [MIGRATION_VMSTATE-0003.zip](/uploads/39d2099d58cf4be79f8550aa2b83dbbe/MIGRATION_VMSTATE-0003.zip)