Stack-based buffer overflow in the vrend_decode_set_framebuffer_state function in vrend_decode.c in virglrenderer before 926b9b3460a48f6454d8bbe9e44313d86a65447f as used in Quick Emulator (QEMU) allows a local guest users to cause a denial of service (application crash) via the \nr_cbufs\ argument.