A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libvirt | Sep 21, 2026 | Aug 10, 2026 |
| Redhat_linux | — | No solution exists | Aug 12, 2026 | Jul 30, 2026 |
| Ubuntu | — | Upgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-vboxUpgrade libvirt-daemon-driver-vbox (Ubuntu Pro)Upgrade libvirt-sanlock (Ubuntu Pro)Upgrade libvirt-daemon-plugin-sanlockUpgrade libvirt-daemon-system-systemd (Ubuntu Pro)Upgrade libvirt-sanlockUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt0 (Ubuntu Pro)Upgrade libvirt-daemon-system (Ubuntu Pro)Upgrade libvirt-daemon-driver-xen (Ubuntu Pro)Upgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-lockUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-devUpgrade libvirt-commonUpgrade libvirt-daemon-driver-storage-sheepdog (Ubuntu Pro)Upgrade libnss-libvirtUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt0Upgrade libvirt-daemon-driver-lxc (Ubuntu Pro)Upgrade libvirt-daemon-system-sysvUpgrade libvirt-daemon-driver-storage-rbd (Ubuntu Pro)Upgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-storage-zfsUpgrade libvirt-daemon-driver-storage-zfs (Ubuntu Pro)Upgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-ssh-proxyUpgrade libvirt-daemon-driver-storage-gluster (Ubuntu Pro)Upgrade libvirt-clientsUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-bin (Ubuntu Pro)Upgrade libvirt-clients-qemuUpgrade libvirt-daemon-system-sysv (Ubuntu Pro)Upgrade libvirt-daemon-logUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-plugin-lockdUpgrade libvirt-daemon (Ubuntu Pro)Upgrade libvirt-daemon-driver-xenUpgrade libvirt-daemon-system-systemdUpgrade libvirt-daemonUpgrade libnss-libvirt (Ubuntu Pro)Upgrade libvirt-wiresharkUpgrade libvirt-daemon-commonUpgrade libvirt-daemon-driver-qemu (Ubuntu Pro)Upgrade libvirt-wireshark (Ubuntu Pro)Upgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-login-shellUpgrade libvirt-daemon-systemUpgrade libvirt-clients (Ubuntu Pro)Upgrade libvirt-dev (Ubuntu Pro) | Aug 20, 2026 | Aug 19, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub