CVE-2025-12748
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Nov 11, 2025
CISA due date
—
The record
A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 15.6 | libvirt | 0 | 10.0.0-150600.8.12.1 |
| openSUSE:Leap 16.0 | libvirt | 0 | 11.4.0-160000.3.1 |
| openSUSE:Tumbleweed | libvirt | 0 | 11.9.0-2.1 |
Related vulnerabilities
- CVE-2025-13193 A flaw was found in libvirt. Also affects libvirt
- CVE-2024-8235 A flaw was found in libvirt. Also affects libvirt
- CVE-2024-1441 An off-by-one error flaw was found in the udevListInterfacesByStatus() function in… Also affects libvirt
- CVE-2023-3750 A flaw was found in libvirt. Also affects libvirt
- CVE-2021-4147 A flaw was found in the libvirt libxl driver. Also affects libvirt
- CVE-2020-15708 Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and… Also affects libvirt
- CVE-2011-4600 The networkReloadIptablesRules function in network/bridge_driver.c in libvirt before… Also affects libvirt
- CVE-2014-3657 The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not… Also affects libvirt