No, QEMU is a huge C program which can have its own vulnerabilities. Usually QEMU runs heavily confined, but remote code execution in QEMU (remote = "from the

No, QEMU is a huge C program which can have its own vulnerabilities. Usually QEMU runs heavily confined, but remote code execution in QEMU (remote = "from the guest") can be a first step towards exploiting a more serious local escalation via a kernel vulnerability. This second vulnerability can be in KVM or in any other part of the kernel.