CVE-2026-63623: Libvirt: information disclosure via world-readable storage volume images during clone/convert
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63623?
The severity of CVE-2026-63623 is rated as medium with a score of 5.5.
What vulnerability does CVE-2026-63623 address?
CVE-2026-63623 addresses an information disclosure vulnerability in libvirt that allows local users to read guest disk contents during certain operations.
How do I fix CVE-2026-63623?
To fix CVE-2026-63623, ensure that the `qemu-img` utility is configured with appropriate file creation permissions to avoid world-readable settings.
What impact does CVE-2026-63623 have on system security?
CVE-2026-63623 can lead to unauthorized access of sensitive data in guest disks by local users due to improperly set file permissions.
Who is affected by CVE-2026-63623?
Any system using libvirt for virtualization that performs storage volume clone or convert operations is potentially affected by CVE-2026-63623.