Zapscape (CVE-2026-64561)

Zapscape (CVE-2026-64561) is a KVM escape vulnerability discovered by Hyunwoo Kim that allows a guest to escape to the host in KVM/x86 environments and execute commands with kernel privileges. The vulnerability is a use-after-free flaw in the shadow MMU emulation's recursive zap path, exploitable through guest-side actions alone, and poses a significant threat to multi-tenant x86 public clouds that support nested virtualization. A proof-of-concept demonstrating the exploit chain on QEMU TCG has been released following the end of the coordinated disclosure embargo.