SUSE-SU-2026:2385-1

Description of the patch:

This update for qemu fixes the following issues:

• CVE-2026-2243: incorrect bounds check leads to heap out-of-bounds read and a 12-byte information leak when processing specially crafted VMDK files (bsc#1258509).
• CVE-2026-3195: heap buffer overflow when reading input audio in the virtio-snd device input callback due to insufficient checks in virtio_snd_pcm_in_cb (bsc#1259080).
• CVE-2026-3196: integer overflow in the virtio-snd device via PCM_INFO requests from the guest leads to unbounded memory allocation and host denial-of-service (bsc#1259079).
• CVE-2026-3842: hyperv/syndbg: missing mapped-length guard after cpu_physical_memory_map causes host OOB write (bsc#1262089).