CVE-2025-13193
Medium · 5.5CVSS
5.5
EPSS
0.1%
Published
Nov 17, 2025
CISA due date
—
The record
A flaw was found in libvirt. External inactive snapshots for shut-down VMs are incorrectly created as world-readable, making it possible for unprivileged users to inspect the guest OS contents. This results in an information disclosure vulnerability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 15.6 | libvirt | 0 | 10.0.0-150600.8.12.1 |
| openSUSE:Leap 16.0 | libvirt | 0 | 11.4.0-160000.3.1 |
| openSUSE:Tumbleweed | libvirt | 0 | 11.9.0-2.1 |
Related vulnerabilities
- CVE-2025-12748 A flaw was discovered in libvirt in the XML file processing. Also affects libvirt
- CVE-2024-8235 A flaw was found in libvirt. Also affects libvirt
- CVE-2024-1441 An off-by-one error flaw was found in the udevListInterfacesByStatus() function in… Also affects libvirt
- CVE-2023-3750 A flaw was found in libvirt. Also affects libvirt
- CVE-2021-4147 A flaw was found in the libvirt libxl driver. Also affects libvirt
- CVE-2020-15708 Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and… Also affects libvirt
- CVE-2011-4600 The networkReloadIptablesRules function in network/bridge_driver.c in libvirt before… Also affects libvirt
- CVE-2014-3657 The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not… Also affects libvirt