CVE-2016-9603

CRITICAL

A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after ...

Affects 9 products across 4 vendors.

CVSS 3.09.9
EPSS4.4%
Percentile91th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-119: Improper Restriction of Operations within Memory Buffer

Parent class for buffer-related vulnerabilities where operations exceed buffer boundaries.

CWE-122: Heap-Based Buffer Overflow

Buffer overflow corrupting dynamically allocated heap memory, exploitable for arbitrary code execution.

Related Attack Patterns (CAPEC)
CAPEC-8 Buffer Overflow in an API Call
via CWE-119
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-119
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-119
CAPEC-14 Client-side Injection-induced Buffer Overflow
via CWE-119
CAPEC-24 Filter Failure through Buffer Overflow
via CWE-119
Show all 13

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2018. A critical vulnerability affects Citrix systems (CVE-2016-9603). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2018-GLOBAL-113126-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2016-9603?
This vulnerability was disclosed in 2018. A critical vulnerability affects Citrix systems (CVE-2016-9603). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
What is the CVSS score for CVE-2016-9603?
CVE-2016-9603 has CVSS 9.9 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS: 4.4%.
Is CVE-2016-9603 actively exploited?
No confirmed active exploitation of CVE-2016-9603 as of 2026-09-25.
How do I remediate CVE-2016-9603?
Priority: MEDIUM. Advisory: https://access.redhat.com/errata/RHSA-2017:0980
What systems are affected by CVE-2016-9603?
CVE-2016-9603 affects Citrix Xenserver; Debian Debian Linux; Qemu Qemu; Redhat Enterprise Linux Workstation, Enterprise Linux Server Aus, Enterprise Linux Server Eus, Openstack, Enterprise Linux Server, Enterprise Linux Desktop.
Vulnerability Details
CVE IDCVE-2016-9603
BSIDBS-2018-GLOBAL-113126-C BreachSpider Global ID
CVSS VectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Published2018-07-27
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
Improper Restriction of Operations within Memory BufferHeap-Based Buffer Overflow
Domains
NETWORK-INFRA
SourceNVD
Official Description

A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update its display after a VGA operation is performed by a guest. A privileged user/process inside a guest could use this flaw to crash the QEMU process or, potentially, execute arbitrary code on the host with privileges of the QEMU process. CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

Exploitation Likelihood: LOW

Affected Products
VendorProductAffected Versions
Citrix Xenserver 6.0.2 6.2.0 6.5 7.0 7.1
Debian Debian Linux 7.0
Qemu Qemu 2.9 < 2.9.0
Redhat Enterprise Linux Workstation 6.0 7.0
Redhat Enterprise Linux Server Aus 7.3 7.4
Redhat Enterprise Linux Server Eus 7.3 7.4 7.5
Redhat Openstack 5.0 6.0 7.0 8 9 10
Redhat Enterprise Linux Server 6.0 7.0
Redhat Enterprise Linux Desktop 6.0 7.0
Remediation
View Vendor Advisory →

Remediation Priority: MEDIUM

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 3002 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashc58bfe71be06a454c67e2750924647bd920e87384f75a2a0abe19258522e5ed52102881fe15418ee1ac6e808b8aa3c225b8fd090ec6700e675dd1038694f570f
Related CVEs affecting Citrix
CVE-2008-0356 10.0 Buffer overflow in the Independent Management Architecture (IMA) service in C... CVE-2008-2528 10.0 Unspecified vulnerability in Citrix Access Gateway Standard Edition 4.5.7 and... CVE-2000-0244 10.0 The Citrix ICA (Independent Computing Architecture) protocol uses weak encryp... CVE-2007-2850 10.0 The Session Reliability Service (XTE) in Citrix MetaFrame Presentation Server... CVE-2009-2452 10.0 Multiple unspecified vulnerabilities in Citrix Licensing 11.5 have unknown im...
View all Citrix CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.9 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →