QEMU QXL display can read past video RAM on a guest-chosen stride
Brief
A VNC or SDL refresh is what walks past the buffer.
Notes
ab7183ed4eec (Marc-Andre Lureau, 2026-08-25). hw/display/qxl. Validate primary surface stride against width. Fixes CVE-2026-16271. Resolves #3637 (closed 2026-08-25, Kind::Security, CVE::Assigned). Reported-by huntr bubble. Reviewed-by Akihiko Odaki.
Landed with fe11f459 Merge tag fixes-pr-v1. Not in v11.1.1, v11.0.4, or v10.0.13. Cite issue plus commit only.
Commit ab7183ed4eecb4727532e3ffe5953d127e102c72