Description (CNA)
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat Enterprise Linux 10 | affected |
| Red Hat / Red Hat Enterprise Linux 6 | affected |
| Red Hat / Red Hat Enterprise Linux 7 | affected |
| Red Hat / Red Hat Enterprise Linux 8 | affected |
| Red Hat / Red Hat Enterprise Linux 9 | affected |
| Red Hat / Red Hat Enterprise Linux for NVIDIA 26 | unknown |
CWE
CWE-732
References
- https://access.redhat.com/security/cve/CVE-2026-63623
- https://bugzilla.redhat.com/show_bug.cgi?id=2513066
ADP enrichment
No English description supplied.
No references supplied.