{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "mm210"
              },
              {
                "fixed": "mm320"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "76eab1fcf2bd94182538e519900791ccb0d88810"
            },
            {
              "fixed": "c6bef93d7909584bbda4e5c87603ea175825f342"
            },
            {
              "fixed": "e295fa32fe9e3219b63e4055971b97dc9f7d84f5"
            }
          ],
          "repo": "https://github.com/virtio-win/kvm-guest-drivers-windows",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-qrhp-4mhp-hjwh"
  ],
  "database_specific": {
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
      "CWE-122",
      "CWE-190"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46655.json"
  },
  "details": "virtio-win provides Windows paravirtualized drivers for QEMU and KVM. From mm210 until mm320, the Viosock driver permits a low-privilege local process to submit an IOCTL_SELECT request with attacker-controlled VIRTIO_VSOCK_SELECT.Fdss[*].fd_count values that overflow the 32-bit sum used by VIOSockSelect for bounds checking. The wrapped sum can pass the FD_SETSIZE check even though an individual descriptor count is much larger than the expected limit. VIOSockSelectCopyFds then iterates using the unchecked count and writes beyond the allocated pPkt-\u003eFds array in the NonPagedPool kernel heap. Successful exploitation can corrupt kernel memory and enable privilege escalation in a Windows guest running the driver. This issue is fixed in mm320.",
  "id": "CVE-2026-46655",
  "modified": "2026-09-20T11:30:47.936461905Z",
  "published": "2026-09-18T16:46:34.832Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/virtio-win/kvm-guest-drivers-windows/releases/tag/mm320"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46655.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/virtio-win/kvm-guest-drivers-windows/security/advisories/GHSA-qrhp-4mhp-hjwh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46655"
    },
    {
      "type": "FIX",
      "url": "https://github.com/virtio-win/kvm-guest-drivers-windows/commit/c6bef93d7909584bbda4e5c87603ea175825f342"
    },
    {
      "type": "FIX",
      "url": "https://github.com/virtio-win/kvm-guest-drivers-windows/pull/1568"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "virtio-win: Integer overflow causing a heap overflow in Viosock driver"
}