[bonzini]

QEMU is huge, but you choose what parts to use. If you stick to the defaults, e.g. your VM has one or more virtio devices, a virtual USB3 controller and USB tablet, maybe an IDE/AHCI controller and an e1000 or rtl8139 NIC, it should be pretty okay.

Because of its use with KVM, QEMU has had its code scrutinized quite closely in the last few years. There are some device models that have a pretty bad track record, such as Cirrus VGA, but they are not the default anymore and there's no reason why you should use them.