{"id":"CVE-2025-13193","aliases":["ALPINE-CVE-2025-13193","AZL-70598","BELL-CVE-2025-13193","DEBIAN-CVE-2025-13193","EUVD-2025-197850","GHSA-223c-8f3h-q9f9","OESA-2025-2891","OESA-2025-2892","OESA-2025-2893","OESA-2025-2894","OESA-2025-2895","OESA-2025-2896","SUSE-SU-2025:21082-1","SUSE-SU-2025:21150-1","SUSE-SU-2026:0068-1","SUSE-SU-2026:0079-1","SUSE-SU-2026:0080-1","SUSE-SU-2026:0193-1","SUSE-SU-2026:0279-1","SUSE-SU-2026:0375-1","SUSE-SU-2026:20050-1","SUSE-SU-2026:21263-1","UBUNTU-CVE-2025-13193","USN-8652-1","openSUSE-SU-2025:15746-1","openSUSE-SU-2025:20100-1"],"status":"published","title":"Libvirt: information disclosure via world-readable vm snapshots","description":"A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00129,"percentile":0.02584,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-276"],"published":"2025-11-17T17:03:48Z","modified":"2026-11-05T21:15:50Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"libvirt","fixed_in":["11.10.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"libvirt","fixed_in":["11.10.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libvirt","fixed_in":["10.0.0-6"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libvirt","fixed_in":["8.9.0-r7"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libvirt","fixed_in":["11.3.0-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libvirt","fixed_in":["11.10.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libvirt","fixed_in":["11.3.0-3+deb13u2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libvirt","fixed_in":["11.10.0-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"libvirt","fixed_in":["6.2.0-26.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"libvirt","fixed_in":["6.2.0-70.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"libvirt","fixed_in":["6.2.0-70.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"libvirt","fixed_in":["9.10.0-19.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"libvirt","fixed_in":["9.10.0-20.oe2403sp1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libvirt","fixed_in":["1.2.2-0ubuntu13.1.28+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libvirt","fixed_in":["1.3.1-1ubuntu10.31+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libvirt","fixed_in":["4.0.0-1ubuntu8.21+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libvirt","fixed_in":["6.0.0-0ubuntu8.20+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libvirt","fixed_in":["8.0.0-1ubuntu7.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libvirt","fixed_in":["10.0.0-2ubuntu8.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"libvirt","fixed_in":["11.6.0-1ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libvirt","fixed_in":["11.6.0-1ubuntu7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.10.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.10.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.9.0-r4"},{"fixed":"8.9.0-r7"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.3.0-r0"},{"fixed":"11.3.0-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.1.0-r2"},{"fixed":"11.10.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.3.0-3+deb13u2"}]}],"versions":["11.3.0-3","11.3.0-3+deb13u1"]},{"source":"osv","ecosystem":"Debian:14","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.10.0-1"}]}],"versions":["11.3.0-3","11.4.0-1","11.5.0-1","11.6.0-1","11.7.0-1","11.8.0-1","11.8.0-2","11.9.0-1","11.9.0-2"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-26.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-70.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-70.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10.0-19.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10.0-20.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10.0-20.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.0-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-150600.8.12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150300.6.44.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-150500.6.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-13.45.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.0-150700.4.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.0-150700.4.13.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-150400.7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-150400.7.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-4.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-slfo.1.1_2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-0ubuntu13.1.28+esm2"}]}],"versions":["1.1.1-0ubuntu8","1.1.1-0ubuntu9","1.1.4-0ubuntu2","1.1.4-0ubuntu3","1.1.4-0ubuntu4","1.1.4-0ubuntu5","1.2.0-0ubuntu1","1.2.0-0ubuntu2","1.2.0-0ubuntu3","1.2.1-0ubuntu1","1.2.1-0ubuntu2","1.2.1-0ubuntu3","1.2.1-0ubuntu4","1.2.1-0ubuntu5","1.2.1-0ubuntu7","1.2.1-0ubuntu8","1.2.1-0ubuntu9","1.2.1-0ubuntu10","1.2.2-0ubuntu1","1.2.2-0ubuntu2","1.2.2-0ubuntu3","1.2.2-0ubuntu4","1.2.2-0ubuntu5","1.2.2-0ubuntu6","1.2.2-0ubuntu7","1.2.2-0ubuntu8","1.2.2-0ubuntu9","1.2.2-0ubuntu10","1.2.2-0ubuntu11","1.2.2-0ubuntu12","1.2.2-0ubuntu13","1.2.2-0ubuntu13.1","1.2.2-0ubuntu13.1.1","1.2.2-0ubuntu13.1.2","1.2.2-0ubuntu13.1.4","1.2.2-0ubuntu13.1.5","1.2.2-0ubuntu13.1.6","1.2.2-0ubuntu13.1.7","1.2.2-0ubuntu13.1.8","1.2.2-0ubuntu13.1.9","1.2.2-0ubuntu13.1.10","1.2.2-0ubuntu13.1.12","1.2.2-0ubuntu13.1.14","1.2.2-0ubuntu13.1.16","1.2.2-0ubuntu13.1.17","1.2.2-0ubuntu13.1.20","1.2.2-0ubuntu13.1.21","1.2.2-0ubuntu13.1.22","1.2.2-0ubuntu13.1.23","1.2.2-0ubuntu13.1.25","1.2.2-0ubuntu13.1.26","1.2.2-0ubuntu13.1.27","1.2.2-0ubuntu13.1.28","1.2.2-0ubuntu13.1.28+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1ubuntu10.31+esm1"}]}],"versions":["1.2.16-2ubuntu11","1.2.16-2ubuntu12","1.2.16-2ubuntu13","1.2.16-2ubuntu14","1.2.21-2ubuntu1","1.2.21-2ubuntu3","1.2.21-2ubuntu4","1.2.21-2ubuntu5","1.2.21-2ubuntu7","1.2.21-2ubuntu8","1.2.21-2ubuntu9","1.2.21-2ubuntu10","1.3.1-1ubuntu1","1.3.1-1ubuntu2","1.3.1-1ubuntu3","1.3.1-1ubuntu4","1.3.1-1ubuntu6","1.3.1-1ubuntu9","1.3.1-1ubuntu10","1.3.1-1ubuntu10.1","1.3.1-1ubuntu10.2","1.3.1-1ubuntu10.3","1.3.1-1ubuntu10.5","1.3.1-1ubuntu10.6","1.3.1-1ubuntu10.7","1.3.1-1ubuntu10.8","1.3.1-1ubuntu10.10","1.3.1-1ubuntu10.11","1.3.1-1ubuntu10.12","1.3.1-1ubuntu10.13","1.3.1-1ubuntu10.14","1.3.1-1ubuntu10.15","1.3.1-1ubuntu10.17","1.3.1-1ubuntu10.18","1.3.1-1ubuntu10.19","1.3.1-1ubuntu10.21","1.3.1-1ubuntu10.22","1.3.1-1ubuntu10.23","1.3.1-1ubuntu10.24","1.3.1-1ubuntu10.25","1.3.1-1ubuntu10.26","1.3.1-1ubuntu10.27","1.3.1-1ubuntu10.29","1.3.1-1ubuntu10.30","1.3.1-1ubuntu10.31"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1ubuntu8.21+esm1"}]}],"versions":["3.6.0-1ubuntu5","3.6.0-1ubuntu6","4.0.0-1ubuntu1","4.0.0-1ubuntu2","4.0.0-1ubuntu3","4.0.0-1ubuntu4","4.0.0-1ubuntu5","4.0.0-1ubuntu6","4.0.0-1ubuntu7","4.0.0-1ubuntu8","4.0.0-1ubuntu8.1","4.0.0-1ubuntu8.2","4.0.0-1ubuntu8.3","4.0.0-1ubuntu8.4","4.0.0-1ubuntu8.5","4.0.0-1ubuntu8.6","4.0.0-1ubuntu8.7","4.0.0-1ubuntu8.8","4.0.0-1ubuntu8.9","4.0.0-1ubuntu8.10","4.0.0-1ubuntu8.11","4.0.0-1ubuntu8.12","4.0.0-1ubuntu8.13","4.0.0-1ubuntu8.14","4.0.0-1ubuntu8.15","4.0.0-1ubuntu8.16","4.0.0-1ubuntu8.17","4.0.0-1ubuntu8.19","4.0.0-1ubuntu8.20","4.0.0-1ubuntu8.21"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-0ubuntu8.20+esm1"}]}],"versions":["5.4.0-0ubuntu5","6.0.0-0ubuntu1","6.0.0-0ubuntu2","6.0.0-0ubuntu3","6.0.0-0ubuntu4","6.0.0-0ubuntu5","6.0.0-0ubuntu6","6.0.0-0ubuntu7","6.0.0-0ubuntu8","6.0.0-0ubuntu8.1","6.0.0-0ubuntu8.2","6.0.0-0ubuntu8.3","6.0.0-0ubuntu8.4","6.0.0-0ubuntu8.5","6.0.0-0ubuntu8.7","6.0.0-0ubuntu8.8","6.0.0-0ubuntu8.9","6.0.0-0ubuntu8.10","6.0.0-0ubuntu8.11","6.0.0-0ubuntu8.12","6.0.0-0ubuntu8.13","6.0.0-0ubuntu8.14","6.0.0-0ubuntu8.15","6.0.0-0ubuntu8.16","6.0.0-0ubuntu8.19","6.0.0-0ubuntu8.20"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-1ubuntu7.15"}]}],"versions":["7.6.0-0ubuntu1","7.6.0-0ubuntu3","8.0.0-1ubuntu3","8.0.0-1ubuntu4","8.0.0-1ubuntu5","8.0.0-1ubuntu6","8.0.0-1ubuntu7","8.0.0-1ubuntu7.1","8.0.0-1ubuntu7.2","8.0.0-1ubuntu7.3","8.0.0-1ubuntu7.4","8.0.0-1ubuntu7.5","8.0.0-1ubuntu7.6","8.0.0-1ubuntu7.7","8.0.0-1ubuntu7.8","8.0.0-1ubuntu7.9","8.0.0-1ubuntu7.10","8.0.0-1ubuntu7.11","8.0.0-1ubuntu7.12","8.0.0-1ubuntu7.13","8.0.0-1ubuntu7.14"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-2ubuntu8.11"}]}],"versions":["9.6.0-1ubuntu1","9.6.0-1ubuntu2","10.0.0-1ubuntu1","10.0.0-2ubuntu1","10.0.0-2ubuntu5","10.0.0-2ubuntu7","10.0.0-2ubuntu8","10.0.0-2ubuntu8.1","10.0.0-2ubuntu8.2","10.0.0-2ubuntu8.3","10.0.0-2ubuntu8.4","10.0.0-2ubuntu8.5","10.0.0-2ubuntu8.6","10.0.0-2ubuntu8.7","10.0.0-2ubuntu8.8","10.0.0-2ubuntu8.9","10.0.0-2ubuntu8.10"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.0-1ubuntu3.2"}]}],"versions":["11.0.0-2ubuntu6","11.0.0-2ubuntu8","11.4.0-1ubuntu1","11.4.0-1ubuntu2","11.6.0-1ubuntu1","11.6.0-1ubuntu2","11.6.0-1ubuntu3","11.6.0-1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.6.0-1ubuntu7"}]}],"versions":["11.6.0-1ubuntu3","11.6.0-1ubuntu5","11.6.0-1ubuntu6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-0ubuntu13.1.28+esm2"}]}],"versions":["1.1.1-0ubuntu8","1.1.1-0ubuntu9","1.1.4-0ubuntu2","1.1.4-0ubuntu3","1.1.4-0ubuntu4","1.1.4-0ubuntu5","1.2.0-0ubuntu1","1.2.0-0ubuntu2","1.2.0-0ubuntu3","1.2.1-0ubuntu1","1.2.1-0ubuntu2","1.2.1-0ubuntu3","1.2.1-0ubuntu4","1.2.1-0ubuntu5","1.2.1-0ubuntu7","1.2.1-0ubuntu8","1.2.1-0ubuntu9","1.2.1-0ubuntu10","1.2.2-0ubuntu1","1.2.2-0ubuntu2","1.2.2-0ubuntu3","1.2.2-0ubuntu4","1.2.2-0ubuntu5","1.2.2-0ubuntu6","1.2.2-0ubuntu7","1.2.2-0ubuntu8","1.2.2-0ubuntu9","1.2.2-0ubuntu10","1.2.2-0ubuntu11","1.2.2-0ubuntu12","1.2.2-0ubuntu13","1.2.2-0ubuntu13.1","1.2.2-0ubuntu13.1.1","1.2.2-0ubuntu13.1.2","1.2.2-0ubuntu13.1.4","1.2.2-0ubuntu13.1.5","1.2.2-0ubuntu13.1.6","1.2.2-0ubuntu13.1.7","1.2.2-0ubuntu13.1.8","1.2.2-0ubuntu13.1.9","1.2.2-0ubuntu13.1.10","1.2.2-0ubuntu13.1.12","1.2.2-0ubuntu13.1.14","1.2.2-0ubuntu13.1.16","1.2.2-0ubuntu13.1.17","1.2.2-0ubuntu13.1.20","1.2.2-0ubuntu13.1.21","1.2.2-0ubuntu13.1.22","1.2.2-0ubuntu13.1.23","1.2.2-0ubuntu13.1.25","1.2.2-0ubuntu13.1.26","1.2.2-0ubuntu13.1.27","1.2.2-0ubuntu13.1.28","1.2.2-0ubuntu13.1.28+esm1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1ubuntu10.31+esm1"}]}],"versions":["1.2.16-2ubuntu11","1.2.16-2ubuntu12","1.2.16-2ubuntu13","1.2.16-2ubuntu14","1.2.21-2ubuntu1","1.2.21-2ubuntu3","1.2.21-2ubuntu4","1.2.21-2ubuntu5","1.2.21-2ubuntu7","1.2.21-2ubuntu8","1.2.21-2ubuntu9","1.2.21-2ubuntu10","1.3.1-1ubuntu1","1.3.1-1ubuntu2","1.3.1-1ubuntu3","1.3.1-1ubuntu4","1.3.1-1ubuntu6","1.3.1-1ubuntu9","1.3.1-1ubuntu10","1.3.1-1ubuntu10.1","1.3.1-1ubuntu10.2","1.3.1-1ubuntu10.3","1.3.1-1ubuntu10.5","1.3.1-1ubuntu10.6","1.3.1-1ubuntu10.7","1.3.1-1ubuntu10.8","1.3.1-1ubuntu10.10","1.3.1-1ubuntu10.11","1.3.1-1ubuntu10.12","1.3.1-1ubuntu10.13","1.3.1-1ubuntu10.14","1.3.1-1ubuntu10.15","1.3.1-1ubuntu10.17","1.3.1-1ubuntu10.18","1.3.1-1ubuntu10.19","1.3.1-1ubuntu10.21","1.3.1-1ubuntu10.22","1.3.1-1ubuntu10.23","1.3.1-1ubuntu10.24","1.3.1-1ubuntu10.25","1.3.1-1ubuntu10.26","1.3.1-1ubuntu10.27","1.3.1-1ubuntu10.29","1.3.1-1ubuntu10.30","1.3.1-1ubuntu10.31"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1ubuntu8.21+esm1"}]}],"versions":["3.6.0-1ubuntu5","3.6.0-1ubuntu6","4.0.0-1ubuntu1","4.0.0-1ubuntu2","4.0.0-1ubuntu3","4.0.0-1ubuntu4","4.0.0-1ubuntu5","4.0.0-1ubuntu6","4.0.0-1ubuntu7","4.0.0-1ubuntu8","4.0.0-1ubuntu8.1","4.0.0-1ubuntu8.2","4.0.0-1ubuntu8.3","4.0.0-1ubuntu8.4","4.0.0-1ubuntu8.5","4.0.0-1ubuntu8.6","4.0.0-1ubuntu8.7","4.0.0-1ubuntu8.8","4.0.0-1ubuntu8.9","4.0.0-1ubuntu8.10","4.0.0-1ubuntu8.11","4.0.0-1ubuntu8.12","4.0.0-1ubuntu8.13","4.0.0-1ubuntu8.14","4.0.0-1ubuntu8.15","4.0.0-1ubuntu8.16","4.0.0-1ubuntu8.17","4.0.0-1ubuntu8.19","4.0.0-1ubuntu8.20","4.0.0-1ubuntu8.21"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-0ubuntu8.20+esm1"}]}],"versions":["5.4.0-0ubuntu5","6.0.0-0ubuntu1","6.0.0-0ubuntu2","6.0.0-0ubuntu3","6.0.0-0ubuntu4","6.0.0-0ubuntu5","6.0.0-0ubuntu6","6.0.0-0ubuntu7","6.0.0-0ubuntu8","6.0.0-0ubuntu8.1","6.0.0-0ubuntu8.2","6.0.0-0ubuntu8.3","6.0.0-0ubuntu8.4","6.0.0-0ubuntu8.5","6.0.0-0ubuntu8.7","6.0.0-0ubuntu8.8","6.0.0-0ubuntu8.9","6.0.0-0ubuntu8.10","6.0.0-0ubuntu8.11","6.0.0-0ubuntu8.12","6.0.0-0ubuntu8.13","6.0.0-0ubuntu8.14","6.0.0-0ubuntu8.15","6.0.0-0ubuntu8.16","6.0.0-0ubuntu8.19","6.0.0-0ubuntu8.20"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-1ubuntu7.19"}]}],"versions":["7.6.0-0ubuntu1","7.6.0-0ubuntu3","8.0.0-1ubuntu3","8.0.0-1ubuntu4","8.0.0-1ubuntu5","8.0.0-1ubuntu6","8.0.0-1ubuntu7","8.0.0-1ubuntu7.1","8.0.0-1ubuntu7.2","8.0.0-1ubuntu7.3","8.0.0-1ubuntu7.4","8.0.0-1ubuntu7.5","8.0.0-1ubuntu7.6","8.0.0-1ubuntu7.7","8.0.0-1ubuntu7.8","8.0.0-1ubuntu7.9","8.0.0-1ubuntu7.10","8.0.0-1ubuntu7.11","8.0.0-1ubuntu7.12","8.0.0-1ubuntu7.13","8.0.0-1ubuntu7.14","8.0.0-1ubuntu7.15","8.0.0-1ubuntu7.16","8.0.0-1ubuntu7.17","8.0.0-1ubuntu7.18"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-2ubuntu8.16"}]}],"versions":["9.6.0-1ubuntu1","9.6.0-1ubuntu2","10.0.0-1ubuntu1","10.0.0-2ubuntu1","10.0.0-2ubuntu5","10.0.0-2ubuntu7","10.0.0-2ubuntu8","10.0.0-2ubuntu8.1","10.0.0-2ubuntu8.2","10.0.0-2ubuntu8.3","10.0.0-2ubuntu8.4","10.0.0-2ubuntu8.5","10.0.0-2ubuntu8.6","10.0.0-2ubuntu8.7","10.0.0-2ubuntu8.8","10.0.0-2ubuntu8.9","10.0.0-2ubuntu8.10","10.0.0-2ubuntu8.11","10.0.0-2ubuntu8.12","10.0.0-2ubuntu8.13","10.0.0-2ubuntu8.14","10.0.0-2ubuntu8.15"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.0-1ubuntu5.3"}]}],"versions":["11.6.0-1ubuntu3","11.6.0-1ubuntu5","11.6.0-1ubuntu6","11.6.0-1ubuntu7","11.6.0-1ubuntu8","12.0.0-1ubuntu3","12.0.0-1ubuntu5","12.0.0-1ubuntu5.1","12.0.0-1ubuntu5.2"],"bundled":9},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.0-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-13193","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2415409","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13193","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-223c-8f3h-q9f9"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-13193","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-13193","tags":["advisory"]},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/13xxx/CVE-2025-13193.json","tags":["advisory"]},{"url":"https://gitlab.com/libvirt/libvirt","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-13193","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2891","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2892","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2893","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2894","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2895","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2896","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-12748","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521082-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1253278","tags":["report"]},{"url":"https://bugzilla.suse.com/1253642","tags":["report"]},{"url":"https://bugzilla.suse.com/1253703","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-12748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-13193","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521150-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260068-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260079-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1251822","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260080-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260193-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260279-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260375-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202620050-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1235079","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621263-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258345","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-13193","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13193","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7047-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8652-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-4147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-1441","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-2494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-2496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-61477","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-61478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63622","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63623","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-13193","title":"Libvirt: information disclosure via world-readable vm snapshots","description":"A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.","status":"published","published":"2025-11-17T17:03:48.291Z","modified":"2026-11-05T14:17:12.956Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-276"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2025-197850","description":"A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.","status":"published","published":"2025-11-17T17:03:48Z","modified":"2026-11-05T14:17:12Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-05T16:59:57.845813Z"}],"ghsa":[{"id":"GHSA-223c-8f3h-q9f9","title":"A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly...","description":"A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.","status":"published","published":"2025-11-17T18:30:31Z","modified":"2025-11-17T18:30:31Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T15:04:50.199532Z"}],"nvd":[{"id":"CVE-2025-13193","description":"A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.","status":"published","published":"2025-11-17T17:15:47.11Z","modified":"2026-11-05T15:17:09.697Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-276"],"updated_at":"2026-11-05T19:55:51.56159Z"}],"osv":[{"id":"ALPINE-CVE-2025-13193","description":"A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.","status":"published","published":"2025-11-17T17:15:47.11Z","modified":"2026-11-03T06:33:00.191456387Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"BELL-CVE-2025-13193","status":"published","published":"2025-11-18T06:06:24.958287Z","modified":"2026-01-26T09:41:23.35468Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"CVE-2025-13193","title":"Libvirt: information disclosure via world-readable vm snapshots","description":"A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.","status":"published","published":"2025-11-17T17:03:48.291Z","modified":"2026-11-07T02:31:03.039592499Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-276"],"updated_at":"2026-11-07T03:07:55.437794Z"},{"id":"DEBIAN-CVE-2025-13193","description":"A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.","status":"published","published":"2025-11-17T17:15:47.11Z","modified":"2026-10-23T17:47:49.631354967Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"OESA-2025-2891","title":"libvirt security update","description":"Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.(CVE-2025-13193)","status":"published","published":"2025-12-30T11:10:01Z","modified":"2026-08-18T01:19:24.65904616Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2025-2892","title":"libvirt security update","description":"Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.(CVE-2025-13193)","status":"published","published":"2025-12-30T11:10:01Z","modified":"2026-08-18T01:19:24.455993516Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2025-2893","title":"libvirt security update","description":"Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.(CVE-2025-13193)","status":"published","published":"2025-12-30T11:10:01Z","modified":"2026-08-18T01:19:24.979956475Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2025-2894","title":"libvirt security update","description":"Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.(CVE-2025-13193)","status":"published","published":"2025-12-30T11:10:01Z","modified":"2026-08-18T01:19:24.648159939Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2025-2895","title":"libvirt security update","description":"Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.(CVE-2025-13193)","status":"published","published":"2025-12-30T11:10:01Z","modified":"2026-08-18T01:19:25.010090725Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"OESA-2025-2896","title":"libvirt security update","description":"Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.\r\n\r\nSecurity Fix(es):\n\nA flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.(CVE-2025-12748)\n\nA flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.(CVE-2025-13193)","status":"published","published":"2025-12-30T11:10:01Z","modified":"2026-08-18T01:19:24.543417665Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:45.339366Z"},{"id":"UBUNTU-CVE-2025-13193","description":"A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.","status":"published","published":"2025-11-17T17:15:00Z","modified":"2026-08-20T05:26:59.810782955Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"AZL-70598","title":"CVE-2025-13193 affecting package libvirt for versions less than 10.0.0-6","description":"A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.","status":"published","published":"2025-11-17T17:15:47Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.144367Z"},{"id":"openSUSE-SU-2025:15746-1","title":"libvirt-11.9.0-2.1 on GA media","description":"These are all security issues fixed in the libvirt-11.9.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-11-19T00:00:00Z","modified":"2026-03-23T04:54:09.894556Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:20100-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n\n- CVE-2025-13193: Fixed Information disclosure via world-readable VM snapshots (bsc#1253703)\n- CVE-2025-12748: Fixed Denial of service in XML parsing (bsc#1253278)\n\nOther fixes:\n\n- spec: Adjust dbus dependency (bsc#1253642)\n- qemu: Add support for Intel TDX (jsc#PED-9265)\n","status":"published","published":"2025-11-27T10:23:20Z","modified":"2026-03-23T04:54:17.084119Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"SUSE-SU-2025:21082-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n\n- CVE-2025-13193: Fixed Information disclosure via world-readable VM snapshots (bsc#1253703)\n- CVE-2025-12748: Fixed Denial of service in XML parsing (bsc#1253278)\n\nOther fixes:\n\n- spec: Adjust dbus dependency (bsc#1253642)\n- qemu: Add support for Intel TDX (jsc#PED-9265)\n","status":"published","published":"2025-11-27T10:24:18Z","modified":"2026-03-23T04:51:10.380501Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:21150-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n\n- CVE-2025-13193: Fixed Information disclosure via world-readable VM snapshots (bsc#1253703)\n- CVE-2025-12748: Fixed Denial of service in XML parsing (bsc#1253278)\n\nOther fixes:\n\n- spec: Adjust dbus dependency (bsc#1253642)\n- qemu: Add support for Intel TDX (jsc#PED-9265)\n","status":"published","published":"2025-11-27T10:24:18Z","modified":"2026-03-23T04:51:14.068074Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2026:0068-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2025-13193: Fixed umask for 'qemu-img' when creating external inactive snapshots (bsc#1253703)\n- CVE-2025-12748: Fixed Check ACLs before parsing the whole domain XML (bsc#1253278)\n","status":"published","published":"2026-01-08T12:22:40Z","modified":"2026-03-23T04:51:55.215025Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0079-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\nSecurity fixes:\n\n  - CVE-2025-13193: Fixed umask for 'qemu-img' when creating external inactive snapshots (bsc#1253703)\n  - CVE-2025-12748: Fixed check ACLs before parsing the whole domain XML (bsc#1253278)\n  \nOther fixes:\n\n  - libvirt-supportconfig: Add support for supportconfig.rc (bsc#1251822)\n","status":"published","published":"2026-01-09T08:01:29Z","modified":"2026-03-23T04:51:55.325535Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0080-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\nSecurity fixes:\n    \n  - CVE-2025-13193: Fixed umask for 'qemu-img' when creating external inactive snapshots (bsc#1253703)\n  - CVE-2025-12748: Fixed check ACLs before parsing the whole domain XML (bsc#1253278)\n\nOther fixes:\n    \n  - libvirt-supportconfig: Add support for supportconfig.rc (bsc#1251822)\n","status":"published","published":"2026-01-09T08:01:44Z","modified":"2026-03-23T04:51:55.941807Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0193-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2025-13193: Fixed umask for 'qemu-img' when creating external inactive snapshots (bsc#1253703)\n- CVE-2025-12748: Fixed check ACLs before parsing the whole domain XML (bsc#1253278)\n","status":"published","published":"2026-01-21T08:04:55Z","modified":"2026-03-23T04:50:24.005572Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0279-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2025-13193: Fixed umask for 'qemu-img' when creating external inactive snapshots (bsc#1253703)\n- CVE-2025-12748: Fixed check ACLs before parsing the whole domain XML (bsc#1253278)\n","status":"published","published":"2026-01-23T15:09:05Z","modified":"2026-03-23T04:52:05.669802Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:0375-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\nSecurity fixes:\n    \n  - CVE-2025-13193: Fixed umask for 'qemu-img' when creating external inactive snapshots (bsc#1253703)\n  - CVE-2025-12748: Fixed check ACLs before parsing the whole domain XML (bsc#1253278)\n\nOther fixes:\n    \n  - libvirt-supportconfig: Add support for supportconfig.rc (bsc#1251822)\n","status":"published","published":"2026-02-04T07:37:40Z","modified":"2026-03-23T04:52:11.528846Z","updated_at":"2026-11-02T15:54:00.846737Z"},{"id":"SUSE-SU-2026:20050-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2025-13193: external inactive snapshots for shut-down VMs that are incorrectly created as world-readable allow\n  unprivileged users to inspect guest OS contents (bsc#1253703).\n- CVE-2025-12748: parsing of user-provided XML files before ACL checks can lead to excessive memory consumption and a\n  crash when processing a specially crafted XML file (bsc#1253278).\n\nOther updates and bugfixes:\n\n- apparmor: Fix probing of apparmor availability on the VM host when using modular daemons (bsc#1235079).\n","status":"published","published":"2026-01-09T11:04:23Z","modified":"2026-03-23T04:52:32.101953Z","updated_at":"2026-11-02T15:54:01.610851Z"},{"id":"SUSE-SU-2026:21263-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2025-12748: Denial of service in XML parsing (bsc#1253278).\n- CVE-2025-13193: Information disclosure via world-readable VM snapshots (bsc#1253703).\n","status":"published","published":"2026-04-21T08:35:17Z","modified":"2026-04-24T18:24:20.461485Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"USN-8652-1","title":"libvirt vulnerabilities","description":"It was discovered that libvirt incorrectly handled guest reboots in the\nlibxl driver. An attacker in a guest could possibly use this issue to\ncause the libvirt daemon to crash, resulting in a denial of service. This\nissue only affected Ubuntu 16.04 LTS. (CVE-2021-4147)\n\nAlexander Kuznetsov discovered that libvirt incorrectly handled listing\nnetwork interfaces. An attacker could possibly use this issue to cause\nthe libvirt daemon to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.\n(CVE-2024-1441)\n\nIt was discovered that libvirt incorrectly handled certain values in its\nRPC library. An attacker could possibly use this issue to cause the\nlibvirt daemon to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.\n(CVE-2024-2494)\n\nIt was discovered that libvirt incorrectly handled listing network\ninterfaces under certain circumstances. An attacker could possibly use\nthis issue to cause the libvirt daemon to crash, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and\nUbuntu 18.04 LTS. (CVE-2024-2496)\n\nIt was discovered that libvirt incorrectly set permissions on external\ninactive snapshots, making them world-readable. A local attacker could\npossibly use this issue to obtain sensitive information. This issue only\naffected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu\n20.04 LTS. (CVE-2025-13193)\n\nIt was discovered that libvirt incorrectly handled certain characters in\nvirtual network definitions. An authenticated user could possibly use\nthis issue to inject arbitrary configuration directives and execute\narbitrary code as root. This issue did not affect Ubuntu 14.04 LTS.\n(CVE-2026-61477)\n\nIt was discovered that libvirt incorrectly handled certain XML input. An\nattacker could possibly use this issue to cause the libvirt daemon to\ncrash, resulting in a denial of service. (CVE-2026-61478)\n\nHe Wei discovered that libvirt incorrectly followed symbolic links when\nchanging file ownership. A local attacker could possibly use this issue\nto escalate privileges. This issue only affected Ubuntu 20.04 LTS, Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63622)\n\nIt was discovered that libvirt incorrectly set permissions on images\nduring storage volume clone and convert operations, making them\ntemporarily world-readable. A local attacker could possibly use this\nissue to obtain sensitive information. (CVE-2026-63623)","status":"published","published":"2026-08-19T16:56:44Z","modified":"2026-08-20T05:29:28.368157919Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}