The qemuAgentCommand function in libvirt before 1.1.1 when a guest agent is not configured allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to \agent based cpu (un)plug \ as demonstrated by the \virsh vcpucount foobar --guest\ command.