---
id: 5666
title: "From virtio-snd 0-day to hypervisor escape: exploiting QEMU with an uncontrolled heap overflow"
source_domain: osec.io
source_url: "https://osec.io/blog/virtio-snd-qemu-hypervisor-escape/"
published_at: "2026-03-17T12:00:00Z"
tags: ["zero-day", "exploit", "heap-overflow", "qemu", "glibc", "virtio", "hypervisor-escape"]
phying_url: "https://phying.com/item/5666"
lang: en
---

# From virtio-snd 0-day to hypervisor escape: exploiting QEMU with an uncontrolled heap overflow

## Summary

OtterSec turns an uncontrolled heap overflow in QEMU's virtio-snd 0-day into a reliable guest-to-host escape using new glibc allocator behavior and QEMU-specific heap sprays.

## Intelligence Metadata

- **Sources:** osec.io
- **Published:** 2026-03-17T12:00:00Z
- **Original:** https://osec.io/blog/virtio-snd-qemu-hypervisor-escape/
- **Phying News:** https://phying.com/item/5666