Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

QEMU bug bounty programs

qemu.org Updated

QEMU runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
11
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program QEMU runs.

  • QEMU

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

11 targets. 6 excluded.

  • https://www.qemu.org

    Web

  • Device passthrough and the IOMMU-facing paths, including vhost and vhost-user backends

    Products and areas

  • Live migration, including the state one host deserialises from another

    Products and areas

  • QEMU's security process splits by use case rather than by component. The virtualization use case is what it triages: a guest that should not be able to reach the host, and a host that should not be exposed by running one. Everything below sits inside that framing

    Products and areas

  • TCG, the translation engine, where guest instruction sequences become host code

    Products and areas

  • The block layer and every disk image format QEMU parses, since an image file is frequently supplied by somebody other than the operator

    Products and areas

  • The firmware and boot interfaces QEMU presents to a guest, which a guest can drive from its first instruction

    Products and areas

  • The host-facing services QEMU exposes: NBD, VNC, SPICE and the character device backends

    Products and areas

  • The QMP and HMP monitor interfaces and anything a management layer drives through them

    Products and areas

  • The whole system-mode device model set: network, block, SCSI, USB, display, audio, character and input devices, emulated and paravirtualised alike

    Products and areas

  • virtio in full, including the shared-memory ring handling that every modern guest drives

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 6

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Findings that depend on a long embargo, since the process refuses arbitrary embargo requests

  • Guest-visible crashes and misbehaviour that stay inside the guest without reaching the host or another tenant

  • Operator configuration decisions, including deliberately exposing a monitor socket or a VNC server with no authentication

  • qemu-user emulation, which is the non-virtualization case in practice and therefore the weakest part of this scope

  • The host kernel, KVM itself and the management stack around QEMU, all of which belong to their own projects

  • The non-virtualization use case, which the process states is generally ineligible. Reports there are converted into public bugs

Recent changes

Reward and scope changes across every QEMU program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in QEMU products, from the NVD.

Search NVD
  • CVE-2025-54567 Medium

    hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327.

  • CVE-2025-54566 Medium

    hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327.

  • CVE-2024-7730 High

    A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtio_snd_pcm_in_cb, the function did not check whether the iov can fit the data buffer. This issue can trigger an out-of-bounds write if the size of the virtio queue element is equal to virtio_snd_pcm_status, which makes the available space for audio data zero.

  • CVE-2024-3447 Medium

    A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.

  • CVE-2024-6519 High

    A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape.

  • CVE-2024-8354 Medium

    A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition.

  • CVE-2024-6505 Medium

    A flaw was found in the virtio-net device in QEMU. When enabling the RSS feature on the virtio-net network card, the indirections_table data within RSS becomes controllable. Setting excessively large values may cause an index out-of-bounds issue, potentially resulting in heap overflow access. This flaw allows a privileged user in the guest to crash the QEMU process on the host.

  • CVE-2024-3567 Medium

    A flaw was found in QEMU. An assertion failure was present in the update_sctp_checksum() function in hw/net/net_tx_pkt.c when trying to calculate the checksum of a short-sized fragmented packet. This flaw allows a malicious guest to crash QEMU and cause a denial of service condition.

About this page

This page gathers every public program listed under qemu.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.