An out-of-bounds read was found in the USB CCID smartcard reader device (hw/usb/dev-smartcard-reader.c) in QEMU. ccid_bulk_in_get() decremented the pending bulk-in slot count when a ring slot became active instead of when it was released, allowing a malicious guest to fill the bulk-in ring, partially read a slot, and then reuse the still-active slot with a shorter response. The resulting stale position exceeds the new buffer length, causing an unsigned-integer underflow in ccid_bulk_in_copy_to_guest() that reads past the response buffer and can disclose host process memory to the guest or crash the QEMU process. The flaw was introduced in QEMU 0.15.0 and fixed in 11.1.3 and 10.0.15.