QEMU is an emulator that can be used with KVM. In the Zapscape proof-of-concept, QEMU is not the vulnerable component; the bug resides in in-kernel KVM and is triggered independently of QEMU's emulation. Kim recommends running the PoC under QEMU TCG for safe testing.