Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 85

Export CSV
CVE-2023-3750

Libvirt: improper locking in virstoragepoolobjlistsearch may lead to denial of service

A flaw was found in libvirt. The virStoragePoolObjListSearch function does not return a locked pool as expected, resulting in a race condition and denial of service when attempting to lock the same object from another thread. This issue could allow clients connecting to the read-only socket to crash the libvirt daemon.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Advanced Virtualization Enterprise Linux Libvirt and 1 more
CVE-2026-61477

Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.

CVSS 3.1 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Enterprise Linux Enterprise Linux For Nvidia 26 and 2 more
CVE-2026-77159

Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Libvirt Rhel Els
CVE-2026-63623

Libvirt: information disclosure via world-readable storage volume images during clone/convert

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Enterprise Linux Enterprise Linux For Nvidia 26 and 2 more
CVE-2024-8235

Libvirt: crash of virtinterfaced via virconnectlistinterfaces()

A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of virtinterfaced. This issue could allow clients connecting to the read-only socket to crash the virtinterfaced daemon.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Advanced Virtualization Enterprise Linux Libvirt and 1 more
CVE-2024-2496

Libvirt: null pointer dereference in udevconnectlistallinterfaces()

A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Advanced Virtualization Enterprise Linux and 2 more
CVE-2026-63622

Libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Enterprise Linux Enterprise Linux Eus and 8 more
CVE-2026-18917

Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow

A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Enterprise Linux Eus Enterprise Linux Nvidia and 7 more
CVE-2008-5086

libvirt: missing checks for read-only connection

Multiple methods in libvirt 0.3.2 through 0.5.1 do not check if a connection is read-only, which allows local users to bypass intended access restrictions and perform administrative actions.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Rhel Virtualization
CVE-2009-0036

libvirt: libvirt_proxy buffer overflow

Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local users to gain privileges by sending a portion of the header of a virProxyPacket packet, and then sending the remainder of the packet with crafted values in the header, related to use of uninitialized memory in a validation check.

CVSS 2.0 · 4.4 Medium EPSS 1.2% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Rhel Virtualization
CVE-2017-1000256

libvirt: TLS certificate verification disabled for clients

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.

CVSS 3.1 · 8.1 High EPSS 1.7% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Libvirt
CVE-2015-0236

libvirt: missing ACL check for the VIR_DOMAIN_XML_SECURE flag in save images and snapshots objects

libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.

CVSS 2.0 · 3.5 Low EPSS 1.8% KEV · Not listed
Vendors
Canonical Mageia Opensuse and 1 more
Products
Ubuntu Linux Mageia Opensuse and 7 more
CVE-2015-5313

libvirt: filesystem storage volume names path traversal flaw

Directory traversal vulnerability in the virStorageBackendFileSystemVolCreate function in storage/storage_backend_fs.c in libvirt, when fine-grained Access Control Lists (ACL) are in effect, allows local users with storage_vol:create ACL but not domain:write permission to write to arbitrary files via a .. (dot dot) in a volume name.

CVSS 3.0 · 2.5 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Libvirt Storage
CVE-2015-5247

libvirt: denial of service when volume creation fails on NFS pool

The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service (libvirtd crash) by triggering a failed unlink after creating a volume on a root_squash NFS pool.

CVSS 3.0 · 6.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Canonical Redhat
Products
Ubuntu Linux Libvirt
CVE-2014-8135

libvirt: local denial of service in storage/storage_driver.c

The storageVolUpload function in storage/storage_driver.c in libvirt before 1.2.11 does not check a certain return value, which allows local users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted offset value in a "virsh vol-upload" command.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Libvirt
CVE-2014-8136

libvirt: local denial of service in qemu/qemu_driver.c

The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Canonical Mageia Opensuse and 1 more
Products
Ubuntu Linux Mageia Opensuse and 7 more
CVE-2016-5008

libvirt: Setting empty VNC password allows access to unauthorized users

libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.

CVSS 3.0 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Enterprise Linux Libvirt and 1 more
CVE-2014-5177

libvirt: unsafe parsing of XML documents allows libvirt DoS and/or arbitrary file read

libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue. NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors.

CVSS 2.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Opensuse Redhat
Products
Opensuse Enterprise Linux Enterprise Virtualization and 1 more
CVE-2014-3657

libvirt: domain_conf: domain deadlock DoS

The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial of service (deadlock) via a NULL value in the second parameter in the virConnectListAllDomains API command.

CVSS 2.0 · 5.0 Medium EPSS 2.8% KEV · Not listed
Vendors
Libvirt Redhat
Products
Libvirt Enterprise Linux
CVE-2014-3672

xen: Unrestricted qemu logging

The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat Xen
Products
Libvirt Xen