CVE-2026-63623: Libvirt: information disclosure via world-readable storage volume images during clone/convert
A file permission vulnerability was found in libvirt's storage volume clone/convert path in src/storage/storageutil.c. The virStorageBackendCreateExecCommand() function ran qemu-img with umask 0 on non-NETFS local storage paths, causing newly created volume images to be world-readable (mode 0644) during the copy operation. libvirt only tightened the file permissions via chmod() after qemu-img completed, creating a window where the full guest disk contents could be read by any local user.
This is the same class of issue as CVE-2025-13193. A local attacker could exploit this race window to read sensitive guest disk contents, resulting in information disclosure.
The fix moves the virCommandSetUmask() call to apply unconditionally to all code paths, ensuring qemu-img creates files with restrictive permissions from the outset.
Upstream fix: https://gitlab.com/libvirt/libvirt/-/commit/69335a484768d550854da1133d5490074695e825
Other sources
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.
— MITRE
Libvirt: information disclosure via world-readable storage volume images during clone/convert
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.10.0-3 - Configuration
Apply the upstream fix by ensuring virCommandSetUmask() is executed unconditionally on all code paths so qemu-img does not run with umask 0 on non-NETFS local storage paths during clone/convert, preventing newly created volume images from being world-readable (mode 0644) during the copy operation.
libvirt (src/storage/storage_util.c / virCommandSetUmask / virStorageBackendCreateExecCommand) umask for qemu-img = set umask unconditionally (not 0) so qemu-img creates files with restrictive permissions from the outset - Operational
After applying the upstream fix, review existing newly created clone/convert volume images created during the vulnerability window and restrict/replace any images that were world-readable (mode 0644) to ensure sensitive guest disk contents are no longer accessible to other local users.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63623?
The severity of CVE-2026-63623 is rated as medium with a score of 5.5.
What vulnerability does CVE-2026-63623 address?
CVE-2026-63623 addresses an information disclosure vulnerability in libvirt that allows local users to read guest disk contents during certain operations.
How do I fix CVE-2026-63623?
To fix CVE-2026-63623, ensure that the `qemu-img` utility is configured with appropriate file creation permissions to avoid world-readable settings.
What impact does CVE-2026-63623 have on system security?
CVE-2026-63623 can lead to unauthorized access of sensitive data in guest disks by local users due to improperly set file permissions.
Who is affected by CVE-2026-63623?
Any system using libvirt for virtualization that performs storage volume clone or convert operations is potentially affected by CVE-2026-63623.