CVE-2025-12748

A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2026:18326
https://access.redhat.com/errata/RHSA-2026:18748
https://access.redhat.com/security/cve/CVE-2025-12748
https://bugzilla.redhat.com/show_bug.cgi?id=2413801

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Se descubrió una falla en libvirt en el procesamiento de archivos XML. Más específicamente, el análisis de archivos XML proporcionados por el usuario se realizaba antes de las comprobaciones de ACL. Un usuario malintencionado con permisos limitados podría exploitar esta falla al enviar un archivo XML especialmente diseñado, lo que provocaría que libvirt asignara demasiada memoria en el host. El consumo excesivo de memoria podría provocar la caída de un proceso de libvirt en el host, lo que resultaría en una condición de denegación de servicio.

Information

Published : 2025-11-11 20:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-12748

Mitre link : CVE-2025-12748

CVE.ORG link : CVE-2025-12748

JSON object : View

Products Affected

No product.

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2025-12748", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12748", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T14:40:15.451605Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "11.9.0"}], "packageName": "libvirt", "collectionURL": "https://gitlab.com/libvirt/libvirt", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "0:11.10.0-12.el10_2", "lessThan": "*", "versionType": "rpm"}], "packageName": "libvirt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9::appstream", "cpe:/a:redhat:enterprise_linux:9::crb"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "0:11.10.0-12.el9_8", "lessThan": "*", "versionType": "rpm"}], "packageName": "libvirt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "packageName": "libvirt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "libvirt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unknown"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "virt:rhel/libvirt", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2025-11-11T20:15:34.453", "references": [{"url": "https://access.redhat.com/errata/RHSA-2026:18326", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2026:18748", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2025-12748", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413801", "source": "secalert@redhat.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition."}, {"lang": "es", "value": "Se descubri\u00f3 una falla en libvirt en el procesamiento de archivos XML. M\u00e1s espec\u00edficamente, el an\u00e1lisis de archivos XML proporcionados por el usuario se realizaba antes de las comprobaciones de ACL. Un usuario malintencionado con permisos limitados podr\u00eda exploitar esta falla al enviar un archivo XML especialmente dise\u00f1ado, lo que provocar\u00eda que libvirt asignara demasiada memoria en el host. El consumo excesivo de memoria podr\u00eda provocar la ca\u00edda de un proceso de libvirt en el host, lo que resultar\u00eda en una condici\u00f3n de denegaci\u00f3n de servicio."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "secalert@redhat.com"}