QEMU VGA can write past the display surface after a mode switch
Brief
Typical pc and q35 guests hit this path.
Notes
418396be8013 (Warisjeet Singh, 2026-08-25). hw/display/vga. Fix text-mode out-of-bounds write after a graphics surface switch. Fixes CVE-2026-77913. Resolves work_items/4215 (issues API 404, treat as non-public). Cc: qemu-stable.
Landed with fe11f459 Merge tag fixes-pr-v1. Not in v11.1.1, v11.0.4, or v10.0.13. Do not invent CVSS. Do not republish a PoC.
Commit 418396be8013386a81f8d8d89ac0effcf03a64b6