● Covered by 1 source · 1 reportMedium impact1 negative
QubesOS Vulnerability Allows Dom0 Arbitrary Code Execution via qvm-copy-to-vm Error Reporting
Key points
- Vulnerability in `qvm-copy-to-vm` error reporting.
- Malicious qube can inject commands into dom0.
- Exploitable if user copies files to a compromised qube.
- Allows attacker to take control of Qubes OS.
Qubes Security Bulletin 118 Issued
Qubes Security Bulletin (QSB) 118 has been published, addressing a critical vulnerability in the QubesOS operating system. The bulletin, dated 2026-08-28, describes a method for arbitrary code execution within dom0, the highly privileged management domain of QubesOS.
Vulnerability Details
The vulnerability resides in the `qvm-copy-to-vm` tool, specifically within its error reporting mechanism. If a user attempts to copy a file from dom0 to a qube that has been compromised by an attacker, the malicious qube can exploit the error reporting backchannel to inject arbitrary commands into dom0. This allows the attacker to gain full control over the Qubes OS system.
Technical Explanation
The `qvm-copy-to-vm` tool utilizes the 'qfile' protocol for file transfers, which includes a transfer confirmation sent from the target qube back to dom0. This confirmation contains a checksum, an error code, and the name of the last received file. The vulnerability occurs when dom0 processes the filename provided by the target qube in case of an error. Although a `sanitize_remote_filename()` function exists, it does not fully prevent the injection of malicious commands through the `last_filename` field before it is passed to the error handler.
User Action and Impact
Users are advised to continue updating their QubesOS installations normally to receive the security patches addressing this issue. No other specific user action is required beyond applying updates. The impact of this vulnerability is significant, as it allows an attacker who has compromised a qube to escalate privileges to dom0, effectively compromising the entire system, provided the user initiates a file copy operation to that compromised qube.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
Qubes Security Bulletin 118 details a vulnerability in QubesOS where using `qvm-copy-to-vm` to copy a file from dom0 to a malicious qube allows the qube to inject an arbitrary command into dom0. This vulnerability enables an attacker to take control of Qubes OS if a user initiates a file copy to a compromised qube.