CVE-2015-8556

CRITICAL ⚠ Exploit

Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.

Affects 1 product across 1 vendor.

CVSS 3.010.0
EPSS13.4%
Percentile96th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-362: Race Condition

Software behavior depends on event timing that is not enforced, allowing attackers to exploit the timing window.

Related Attack Patterns (CAPEC)
CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions
via CWE-362
CAPEC-26 Leveraging Race Conditions
via CWE-362

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A local privilege escalation vulnerability exists in the Gentoo QEMU package before version 2.5.0-r1, allowing a local attacker to gain elevated privileges.

BSID: BS-2017-GLOBAL-158717-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2015-8556?
A local privilege escalation vulnerability exists in the Gentoo QEMU package before version 2.5.0-r1, allowing a local attacker to gain elevated privileges.
What is the CVSS score for CVE-2015-8556?
CVE-2015-8556 has CVSS 10.0 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 13.4%.
Is CVE-2015-8556 actively exploited?
Public exploit available for CVE-2015-8556. Exploitation risk elevated.
How do I remediate CVE-2015-8556?
Priority: IMMEDIATE.
What systems are affected by CVE-2015-8556?
CVE-2015-8556 affects Qemu Qemu.
Vulnerability Details
CVE IDCVE-2015-8556
BSIDBS-2017-GLOBAL-158717-C BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2017-03-24
Last Modified2026-05-13
ICS Relevance0%
Weakness (CWE)
Race Condition
SourceNVD
Official Description

Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is due to improper handling of certain system calls or file permissions within the QEMU package, enabling a local user to execute arbitrary code with elevated privileges.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Qemu Qemu ≤ 2.4.1
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 3492 Days
CISA known-exploitedNot in KEV catalog
Public Exploit⚠ Available — Reference
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
Related CVEs affecting Qemu
CVE-2022-36648 10.0 The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model ... CVE-2017-16845 10.0 hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during gue... CVE-2016-9603 9.9 A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator... CVE-2009-3616 9.9 Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.... CVE-2017-2620 9.9 Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator...
View all Qemu CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →