In QEMU's USB redirection (usbredir) implementation, a use-after-free vulnerability exists in the usbredir_buffered_bulk_packet() function in hw/usb/redirect.c. When processing a
multi-fragment buffered bulk packet that is split into max-packet-size chunks, only the final fragment owns the shared parser memory allocation (via free_on_destroy). If bufp_alloc()
drops the final fragment due to queue overflow, it frees the backing buffer while earlier fragments already queued still hold interior pointers into it. Subsequent guest bulk-IN
transfers then read from freed heap memory. A malicious or compromised USB device (or a crafted usbredir stream) could trigger this condition, potentially leading to information
disclosure from heap memory or a QEMU process crash (denial of service). This vulnerability has existed since QEMU v1.4.0-rc0 and is fixed in v11.0.3 and v10.0.12.