What’s Vulnerable › Vulnerabilities

CVE-2026-63623: Libvirt: information disclosure via world-readable storage volume images during clone/convert

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-10 · updated 2026-08-14
• Weakness: CWE-732

Description

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.

Affected products

• Red Hat Enterprise Linux 10: all versions
• Red Hat Enterprise Linux 6: all versions
• Red Hat Enterprise Linux 7: all versions
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux 9: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-63623
• https://bugzilla.redhat.com/show_bug.cgi?id=2513066

Get alerted when CVE-2026-63623 or the next vulnerability affects your stack