Servers and applications
CVE-2015-3456
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.
- Severity
- High 7.7
- Published
- 13 May 2015
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 15% in the next 30 daysHigher than 96% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- Memory buffer errors (CWE-119)
- Attack
- From the same local network · Needs a login
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
AV:A/AC:L/Au:S/C:C/I:C/A:C- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
XenServers and applications · cpe:o:xen:xen |
|