This update for qemu fixes the following issue:
* CVE-2025-14876: qemu-kvm: Unbounded allocation in virtio-crypto
(bsc#1255400).
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* Server Applications Module 15-SP7
zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP7-2026-889=1
* openSUSE Leap 15.5
zypper in -t patch SUSE-2026-889=1
* SUSE Linux Enterprise Micro 5.5
zypper in -t patch SUSE-SLE-Micro-5.5-2026-889=1
* Server Applications Module 15-SP7 (noarch)
* qemu-sgabios-8-150500.49.39.2
* openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586)
* qemu-block-dmg-debuginfo-7.1.0-150500.49.39.2
* qemu-hw-usb-redirect-7.1.0-150500.49.39.2
* qemu-hw-display-qxl-debuginfo-7.1.0-150500.49.39.2
* qemu-ui-curses-debuginfo-7.1.0-150500.49.39.2
* qemu-hw-usb-smartcard-7.1.0-150500.49.39.2
* qemu-accel-qtest-7.1.0-150500.49.39.2
* qemu-ppc-debuginfo-7.1.0-150500.49.39.2
* qemu-hw-s390x-virtio-gpu-ccw-debuginfo-7.1.0-150500.49.39.2
* qemu-hw-display-qxl-7.1.0-150500.49.39.2
* qemu-hw-s390x-virtio-gpu-ccw-7.1.0-150500.49.39.2
* qemu-guest-agent-debuginfo-7.1.0-150500.49.39.2
* qemu-hw-display-virtio-vga-debuginfo-7.1.0-150500.49.39.2
* qemu-audio-dbus-7.1.0-150500.49.39.2
* qemu-hw-usb-host-7.1.0-150500.49.39.2
* qemu-block-nfs-7.1.0-150500.49.39.2
* qemu-ui-spice-app-debuginfo-7.1.0-150500.49.39.2
* qemu-block-curl-debuginfo-7.1.0-150500.49.39.2
* qemu-block-iscsi-debuginfo-7.1.0-150500.49.39.2
*...
Read the Full Advisory* bsc#1255400
## References:
* https://www.suse.com/security/cve/CVE-2025-14876.html
* https://bugzilla.suse.com/show_bug.cgi?id=1255400
Get the latest Linux and open source security news straight to your inbox.