Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12

Export CSV
CVE-2026-61477

Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.

CVSS 3.1 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Enterprise Linux Enterprise Linux For Nvidia 26 and 2 more
CVE-2026-63623

Libvirt: information disclosure via world-readable storage volume images during clone/convert

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Enterprise Linux Enterprise Linux For Nvidia 26 and 2 more
CVE-2026-63622

Libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Enterprise Linux Enterprise Linux Eus and 8 more
CVE-2008-5086

libvirt: missing checks for read-only connection

Multiple methods in libvirt 0.3.2 through 0.5.1 do not check if a connection is read-only, which allows local users to bypass intended access restrictions and perform administrative actions.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Rhel Virtualization
CVE-2009-0036

libvirt: libvirt_proxy buffer overflow

Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local users to gain privileges by sending a portion of the header of a virProxyPacket packet, and then sending the remainder of the packet with crafted values in the header, related to use of uninitialized memory in a validation check.

CVSS 2.0 · 4.4 Medium EPSS 1.2% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Rhel Virtualization
CVE-2014-3633

libvirt: qemu: out-of-bounds read access in qemuDomainGetBlockIoTune() due to invalid index

The qemuDomainGetBlockIoTune function in qemu/qemu_driver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cause a denial of service (crash) or read sensitive heap information via a crafted blkiotune query, which triggers an out-of-bounds read.

CVSS 2.0 · 5.8 Medium EPSS 2.8% KEV · Not listed
Vendors
Canonical Libvirt Redhat
Products
Ubuntu Linux Libvirt Enterprise Linux
CVE-2014-3657

libvirt: domain_conf: domain deadlock DoS

The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command.

CVSS 2.0 · 5.0 Medium EPSS 2.8% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Enterprise Linux
CVE-2010-2237

libvirt: ignoring defined main disk format when looking up disk backing stores

Red Hat libvirt, possibly 0.6.1 through 0.8.2, looks up disk backing stores without referring to the user-defined main disk format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Libvirt
Products
Libvirt
CVE-2010-2242

libvirt: improperly mapped source privileged ports may allow for obtaining privileged resources on the host

Red Hat libvirt 0.2.0 through 0.8.2 creates iptables rules with improper mappings of privileged source ports, which allows guest OS users to bypass intended access restrictions by leveraging IP address and source-port values, as demonstrated by copying and deleting an NFS directory tree.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Rhel Virtualization
CVE-2010-2239

libvirt: not setting user defined backing store format when creating new image

Red Hat libvirt, possibly 0.6.0 through 0.8.2, creates new images without setting the user-defined backing-store format, which allows guest OS users to read arbitrary files on the host OS via unspecified vectors.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Rhel Virtualization
CVE-2010-2238

libvirt: ignoring defined disk backing store format when recursing into disk image backing stores

Red Hat libvirt, possibly 0.7.2 through 0.8.2, recurses into disk-image backing stores without extracting the defined disk backing-store format, which might allow guest OS users to read arbitrary files on the host OS, and possibly have unspecified other impact, via unknown vectors.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Libvirt
Products
Libvirt
CVE-2015-5160

libvirt: Ceph id/key leaked in the process list

libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Enterprise Linux Enterprise Linux Desktop and 8 more