In QEMU's sysbus-xhci (USB 3.0 host controller) emulation (hw/usb/hcd-xhci.c, hw/usb/hcd-xhci-sysbus.c), an out-of-bounds heap access vulnerability exists in the xhci_sysbus_intr_
raise() function. Some machine types (e.g., microvm) instantiate a sysbus-xhci device with only 1 interrupt by setting the "intrs" property to 1, causing xhci_sysbus_realize() to
allocate the s->irq array with a single entry. When the guest writes to the ERDP register of an XHCI interrupter with index n > 0, the generic XHCI code calls xhci_sysbus_intr_raise(
) with an out-of-bounds index, accessing s->irq[n] at a bad heap address. The subsequent qemu_set_irq() call then invokes an IRQ handler via a function pointer read from that
corrupted heap location, potentially leading to a QEMU crash (segmentation fault) or arbitrary code execution if the pointer targets executable memory. Fixed in QEMU v11.0.3 and
v10.0.12.