VulnerabilityAwaiting Analysis
CVE-2026-63623
This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents.
MEDIUM 5.5EPSS 0.10%
Does this matter?
Lower severity and a low EPSS score (0.10%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.10% probability · 1th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-732
- Source
- secalert@redhat.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.