CVE-2025-12748

EUVD-2025-99083

11.11.2025, 20:15

A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.5 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 8%

Debian Releases

Debian Product

Codename

libvirt

bookworm	no-dsa
bullseye	postponed
bullseye (security)	vulnerable
forky	12.4.0-1 fixed
sid	12.4.0-1 fixed
trixie	11.3.0-3+deb13u2 fixed

Ubuntu Releases

Ubuntu Product

Codename

libvirt

bionic	needs-triage
focal	needs-triage
jammy	Fixed 8.0.0-1ubuntu7.15 released
noble	Fixed 10.0.0-2ubuntu8.11 released
plucky	Fixed 11.0.0-2ubuntu6.5 released
questing	Fixed 11.6.0-1ubuntu3.2 released
resolute	Fixed 11.6.0-1ubuntu7 released
trusty	needs-triage
xenial	needs-triage

openSUSE / SLES Releases

openSUSE Product

Release

libvirt

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-client

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-client-qemu

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-common

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-config-network

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-config-nwfilter

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-interface

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-libxl

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-network

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-nodedev

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-nwfilter

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-qemu

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-secret

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-storage

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-storage-core

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-storage-disk

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-storage-iscsi

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-storage-iscsi-direct

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-storage-logical

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-storage-mpath

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-storage-rbd

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-driver-storage-scsi

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-hooks

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-lock

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-log

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-plugin-lockd

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-plugin-sanlock

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-proxy

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-qemu

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-daemon-xen

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-devel

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-doc

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

libvirt-libs

suse enterprise server 15 SP4

8.0.0-150400.7.14.1

fixed

libvirt-lock-sanlock

suse enterprise server 15 SP4

8.0.0-150400.7.14.1

fixed

libvirt-nss

suse enterprise sap 15 SP7	11.0.0-150700.4.13.1 fixed
suse enterprise server 15 SP4	8.0.0-150400.7.14.1 fixed
suse enterprise server 15 SP7	11.0.0-150700.4.13.1 fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

libvirt

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-client

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-client-qemu

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-common

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-config-network

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-config-nwfilter

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-driver-interface

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-driver-network

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-driver-nodedev

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-driver-nwfilter

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-driver-qemu

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-driver-secret

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-driver-storage

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-driver-storage-core

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-driver-storage-disk

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-driver-storage-iscsi

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-driver-storage-logical

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-driver-storage-mpath

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-driver-storage-rbd

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-driver-storage-scsi

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-kvm

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-lock

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-log

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-plugin-lockd

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-plugin-sanlock

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-daemon-proxy

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-devel

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-docs

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-libs

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-nss

RHEL 9

0:11.10.0-12.el9_8

fixed

libvirt-ssh-proxy

RHEL 9

0:11.10.0-12.el9_8

fixed

Amazon Linux Releases

Amazon Package

Release

libvirt

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-admin

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-bash-completion

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-client

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-config-network

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-config-nwfilter

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-interface

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-lxc

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-network

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-nodedev

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-nwfilter

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-qemu

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-secret

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-storage

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-storage-core

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-storage-disk

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-storage-gluster

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-storage-iscsi

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-storage-logical

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-storage-mpath

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-storage-rbd

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-driver-storage-scsi

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-kvm

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-daemon-lxc

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-debuginfo

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-devel

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-docs

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-libs

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-lock-sanlock

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-login-shell

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

libvirt-nss

Amazon Linux 2

0:4.5.0-36.amzn2.3.2

fixed

Azure Linux Releases

Azure Package

Release

libvirt

Azure Linux 3.0	0:10.0.0-7.azl3 fixed
CBL-Mariner 2.0	0:7.10.0-11.cm2 fixed

Common Weakness Enumeration

CWE-770 - Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

https://access.redhat.com/errata/RHSA-2026:18326

https://access.redhat.com/errata/RHSA-2026:18748

https://access.redhat.com/security/cve/CVE-2025-12748

https://bugzilla.redhat.com/show_bug.cgi?id=2413801