A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libvirt | Dec 5, 2025 | Nov 17, 2025 |
| Debian | — | Upgrade libvirt | Jul 23, 2026 | Jul 23, 2026 |
| Freebsd | — | Upgrade libvirt | Dec 10, 2025 | Dec 4, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Nov 12, 2025 |
| Ubuntu | — | Upgrade libvirt-daemon-driver-xenUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-clients-qemuUpgrade libvirt-daemon-driver-storage-sheepdog (Ubuntu Pro)Upgrade libvirt-daemon-logUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-commonUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-bin (Ubuntu Pro)Upgrade libvirt-daemon-system (Ubuntu Pro)Upgrade libvirt-daemon-driver-vboxUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-commonUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon (Ubuntu Pro)Upgrade libvirt-daemon-plugin-lockdUpgrade libvirt-daemon-system-systemdUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-zfsUpgrade libvirt-daemon-driver-xen (Ubuntu Pro)Upgrade libvirt-daemon-system-systemd (Ubuntu Pro)Upgrade libvirt-daemon-driver-networkUpgrade libnss-libvirtUpgrade libvirt-ssh-proxyUpgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-daemon-system-sysvUpgrade libvirt-dev (Ubuntu Pro)Upgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-qemuUpgrade libnss-libvirt (Ubuntu Pro)Upgrade libvirt-daemon-driver-lxc (Ubuntu Pro)Upgrade libvirt-devUpgrade libvirt-wiresharkUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-lockUpgrade libvirt-sanlockUpgrade libvirt0Upgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-plugin-sanlockUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-clientsUpgrade libvirt-sanlock (Ubuntu Pro)Upgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-wireshark (Ubuntu Pro)Upgrade libvirt-daemon-driver-qemu (Ubuntu Pro)Upgrade libvirt-daemon-driver-storage-zfs (Ubuntu Pro)Upgrade libvirt-login-shellUpgrade libvirt-daemon-driver-storage-gluster (Ubuntu Pro)Upgrade libvirt-daemon-driver-storage-rbd (Ubuntu Pro)Upgrade libvirt-daemon-systemUpgrade libvirt0 (Ubuntu Pro)Upgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-vbox (Ubuntu Pro)Upgrade libvirt-clients (Ubuntu Pro)Upgrade libvirt-daemon-system-sysv (Ubuntu Pro)Upgrade libvirt-daemon-driver-storage | Jan 9, 2026 | Nov 17, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 13, 2026 | Nov 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub