CVE-2025-12748
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.
Risk Assessment
The risk is that an unprivileged user can perform a DoS attack, potentially disrupting virtualization services on the host and affecting the availability of critical systems.
Recommendation
Update libvirt to the patched version immediately. Until the update is applied, restrict access to interfaces accepting XML files and monitor memory usage by libvirt processes.
Other vulnerabilities in libvirt
See all- CVE-2017-1000256High
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of 'verify-peer=no', resulting in a failure to validate SSL/TLS certificates by default.
- CVE-2016-5008Critical
In libvirt versions before 2.0.0, password checking is improperly disabled when the password on a VNC server is set to an empty string. This allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.
- CVE-2026-18917High
A flaw in libvirt allows an unprivileged local user to exploit an integer overflow in the NodeGetFreePages RPC handler, bypassing a size check and leading to a heap buffer overflow. This can corrupt the root libvirt daemon's memory, potentially causing DoS or local privilege escalation.
- CVE-2026-63622High
A vulnerability was found in libvirt where the virFileChownFiles() function follows symbolic links. A local attacker running as the swtpm user can plant a symlink in the swtpm state directory, causing the root-level libvirt daemon to change ownership of an arbitrary file to the swtpm user.
- CVE-2026-63623Medium
In libvirt, during storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.
- CVE-2026-61477Low
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.
- CVE-2025-13193Medium
A flaw was found in libvirt where external inactive snapshots for shut-down VMs are incorrectly created as world-readable, allowing unprivileged users to inspect guest OS contents. This results in an information disclosure vulnerability.
- CVE-2023-3750Medium
A flaw was found in libvirt where the virStoragePoolObjListSearch function does not return a locked pool as expected, leading to a race condition and denial of service when attempting to lock the same object from another thread.
Original NVD description (English source)
A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.