The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a denial of service (out-of-bounds write and guest crash) or possibly execute arbitrary code via the (1) FD_CMD_READ_ID, (2) FD_CMD_DRIVE_SPECIFICATION_COMMAND, or other unspecified commands, aka VENOM.
Conclusion & alert: CVE-2015-3456 is rated High Exploit Risk (75.5/100): CVSS High severity, with high exploitation likelihood (EPSS 15.28%, 96th percentile). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| 37053 | exploit_db | edb | 2015-05-18 | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 19.32% | 15.28% | -4.05% |
| 2 | 2026-06-01 | 24.20% | 19.32% | -4.87% |
| 3 | 2026-05-22 | — | 24.20% | — |
Full EPSS history (25 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.7 | 2.0 | HIGH |
|
5.1 | 10.0 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2015-3456 not yet assigned priority: Debian including 3 source packages (qemu, virtualbox, xen), 11 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 11. | https://security-tracker.debian.org/tracker/CVE-2015-3456 |
gentoo
|
normal | CVE-2015-3456: 3 GLSA(s) (201602-01, 201604-03, 201612-27), 7 atom(s) (app-emulation/pvgrub, app-emulation/qemu, …); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2015-3456 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2015-3456 |
suse
|
medium | CVE-2015-3456 severity moderate: SUSE including 990 source package names (amazon/suse-sles-15-sp1-chost-byos-v20210304-hvm-ssd-x86_64, amazon/suse-sles-15-sp1-chost-byos-v20220127-hvm-ssd-x86_64, …), 1317 product×package rows across 74 product lines (HPE Helion OpenStack 8, SUSE Liberty Linux 7, … (74 product lines)): Fixed 1008, Known Affected 157, Known Not Affected 152. | https://www.suse.com/security/cve/CVE-2015-3456/ |
ubuntu
|
high | CVE-2015-3456 high priority: Ubuntu including 4 source packages (qemu, qemu-kvm, virtualbox, xen), 21 status rows across 6 suites (lucid, precise, trusty, upstream, utopic, vivid): released 11, DNE 5, needs-triage 4, not-affected 1. | https://ubuntu.com/security/CVE-2015-3456 |
: Though the VENOM vulnerability is also agnostic of the guest operating system, an attacker (or an attacker’s malware) would need to have administrative or root privileges in the guest operating system in order to exploit VENOM
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| qemu | qemu | <= 2.3.0 | cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* |
| redhat | enterprise_virtualization | 3.0 | cpe:2.3:a:redhat:enterprise_virtualization:3.0:*:*:*:*:*:*:* |
| redhat | openstack | 4.0 | cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:* |
| redhat | openstack | 5.0 | cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:* |
| redhat | openstack | 6.0 | cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:* |
| redhat | openstack | 7.0 | cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux | 5 | cpe:2.3:o:redhat:enterprise_linux:5:*:*:*:*:*:*:* |
| redhat | enterprise_linux | 6.0 | cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux | 7.0 | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
| xen | xen | 4.5.0 | cpe:2.3:o:xen:xen:4.5.0:*:*:*:*:*:*:* |