CVE-2025-6603 coldfunction qCUDA qcow.c qcow_make_empty integer overflow
An integer overflow in qCUDA's qcow_make_empty function allows local attackers to cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-6603?
CVE-2025-6603 is a medium-severity vulnerability in coldfunction qCUDA, published on 25 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was found in coldfunction qCUDA up to db0085400c2f2011eed46fbc04fdc0873141688e. It has been rated as problematic. Affected by this issue is the function qcow_make_empty of the file qCUDA/qcu-device/block/qcow.c. The manipulation of the argument s->l1_size leads to integer overflow. The attack needs to be approached locally. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.
Which versions are affected by CVE-2025-6603?
How do I fix CVE-2025-6603?
No fix has been published for CVE-2025-6603 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-6603 being exploited?
There is no known exploitation of CVE-2025-6603 in the wild and no public exploit code.
Sources
Also known as GHSA-xrg4-h4p3-4856.