{"id":"CVE-2025-14946","aliases":["DEBIAN-CVE-2025-14946","EUVD-2025-204536","GHSA-mcgc-vc2p-cf7x","UBUNTU-CVE-2025-14946","openSUSE-SU-2025:15842-1"],"status":"published","title":"Libnbd: libnbd: arbitrary code execution via ssh argument injection through a malicious uri","description":"A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.","severity":{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00144,"percentile":0.03719,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-88"],"published":"2025-12-19T13:02:38Z","modified":"2026-11-06T10:03:24Z","fixes":[{"ecosystem":"Debian:14","package":"libnbd","fixed_in":["1.22.5-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libnbd","fixed_in":["1.24.0-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.2-1","1.22.3-1","1.22.5-1","1.24.0-1","1.24.0-2","1.24.0-2.1","1.24.1-1","1.24.2-1","1.24.2-2","1.24.3-1","1.24.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.5-1"}]}],"versions":["1.22.2-1","1.22.3-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.3-1","1.2.1-2","1.2.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.3-1","1.8.5-1","1.10.2-1","1.10.5-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.16.4-1","1.18.1-1","1.18.2-1","1.18.2-1build1","1.18.2-2","1.18.2-2build1","1.20.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.0-1","1.22.2-1build1","1.22.2-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.2-1build2","1.24.0-2ubuntu1","1.24.1-1ubuntu6","1.24.2-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libnbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-2.1"}]}]}],"products":[{"vendor":"red hat","product":"libnbd"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift virtualization 4"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2025-14946","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2423789","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://libguestfs.org/libnbd-release-notes-1.24.1.html#Security","tags":["web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14946","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mcgc-vc2p-cf7x"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14946.json","tags":["advisory"]},{"url":"https://gitlab.com/nbdkit/libnbd","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-14946","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-14946","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-14946","tags":["report"]},{"url":"https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/YZMBF3SJRWTRVT5L3KWSNHITFTRMQNTT/","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-14946","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-14946","title":"Libnbd: libnbd: arbitrary code execution via ssh argument injection through a malicious uri","description":"A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.","status":"published","published":"2025-12-19T13:02:38.342Z","modified":"2026-11-05T14:18:23.782Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-88"],"updated_at":"2026-11-05T16:36:33.176634Z"}],"euvd":[{"id":"EUVD-2025-204536","description":"A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.","status":"published","published":"2025-12-19T13:02:38Z","modified":"2026-11-05T14:18:23Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-05T16:59:57.845813Z"}],"ghsa":[{"id":"GHSA-mcgc-vc2p-cf7x","title":"A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a...","description":"A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.","status":"published","published":"2025-12-19T15:31:19Z","modified":"2025-12-19T15:31:24Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T15:05:18.038899Z"}],"nvd":[{"id":"CVE-2025-14946","description":"A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.","status":"published","published":"2025-12-19T13:16:03.127Z","modified":"2026-11-05T15:17:12.163Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-88"],"updated_at":"2026-11-05T19:55:53.17268Z"}],"osv":[{"id":"CVE-2025-14946","title":"Libnbd: libnbd: arbitrary code execution via ssh argument injection through a malicious uri","description":"A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.","status":"published","published":"2025-12-19T13:02:38.342Z","modified":"2026-11-07T02:30:32.588094955Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-88"],"updated_at":"2026-11-07T03:07:55.623636Z"},{"id":"DEBIAN-CVE-2025-14946","description":"A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.","status":"published","published":"2025-12-19T13:16:03.127Z","modified":"2026-11-06T10:03:24.209447168Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-06T10:38:30.18578Z"},{"id":"UBUNTU-CVE-2025-14946","description":"A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.","status":"published","published":"2025-12-19T13:16:00Z","modified":"2026-05-20T16:20:23.319863296Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"openSUSE-SU-2025:15842-1","title":"libnbd-1.24.0-2.1 on GA media","description":"These are all security issues fixed in the libnbd-1.24.0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-12-23T00:00:00Z","modified":"2026-03-23T04:54:14.239562Z","updated_at":"2026-11-02T16:58:38.101535Z"}]}}