QEMU fixes guest-triggerable VGA heap overflow

QEMU has a fix for a guest-triggerable heap overflow in its VGA display emulation, tracked as CVE-2026-17516. A malicious guest could overflow a host-side buffer by switching between text and graphics modes in a particular sequence, writing well past the allocated size on every scanline refresh.

The bug sits in how the VGA code tracks display geometry. The same width and height fields are reused for both text and graphics rendering, but text mode counts in characters and graphics mode in pixels. Reallocation of the horizontal panning buffer only ran when those fields appeared to change. A guest could enter a narrow graphics mode (allocating a small buffer), switch to a wide text mode (updating the shared width to a large character count without touching the buffer), then return to graphics at a pixel width that numerically matched that character count. The size check then skipped the realloc, and scanline drawing wrote a full-width line into the still-tiny buffer,about 960 bytes past the end per line when pel panning was enabled.

Marc-André Lureau posted the fix, based on work by Warisjeet Singh: always reallocate the panning buffer when entering graphics drawing, so mode-switch unit confusion can no longer leave it undersized. Hosts that expose emulated VGA to untrusted guests should take the update.