QEMU's vhost inflight migration VMState handling uses a uint64_t field for the destination buffer size, while the VMS_VBUFFER load path reads the field as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set can cause the negative value to be converted to a very large size_t. QEMU may then copy migration-stream data beyond the mmap-backed destination inflight region, causing a destination QEMU process crash or memory corruption. Exploitation requires control of the migration producer or write access to the migration channel and a configuration using vhost inflight migration.

Acknowledgments: Seungjung Kim (Kyonggi University)