The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7815