CVE-2026-63623
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
36/100
Published: 2026-08-10
Modified: 2026-11-05
First seen: 2026-11-05
Status: active
Attack Surface
Low Complexity
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
None
A:
None
Description
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.
Weakness Classification (1)
References & Advisories (2)
vdb-entry
x_refsource_REDHAT
issue-tracking
x_refsource_REDHAT