{"id":"EUVD-2025-38316","enisaUuid":"f07b5987-99d9-35cb-8f6d-044393435d5f","description":"KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementation of this feature and more specifically the `DiskOrCreate` option (which creates a file if it doesn\u0027t exist) has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system. Versions 1.6.1 and 1.7.0 fix the issue.","datePublished":"Nov 18, 2025, 10:10:19 PM","dateUpdated":"Feb 26, 2026, 4:21:07 PM","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/kubevirt/kubevirt/security/advisories/GHSA-46xp-26xh-hpqh\nhttps://github.com/kubevirt/kubevirt/pull/15037\nhttps://github.com/kubevirt/kubevirt/commit/00d03e43e3bf03e563136695a4732b65ed42d764\nhttps://github.com/kubevirt/kubevirt/commit/ff3b69b08b6b9c8d08d23735ca8d82455f790a69\n","aliases":"CVE-2025-64324\nGHSA-46xp-26xh-hpqh\n","assigner":"GitHub_M","epss":0.24,"enisaIdProduct":[{"id":"54bcdab5-2323-3768-a15b-7aa6709490de","product":{"name":"kubevirt","vendor":{"name":"KubeVirt"}},"product_version":"1.7.0-alpha.0 \u003c1.7.0-rc.0"},{"id":"8c2876a6-18c7-3717-a4eb-7d1ddcc01f71","product":{"name":"kubevirt","vendor":{"name":"KubeVirt"}},"product_version":"0 \u003c1.6.1"}],"enisaIdVendor":[{"id":"19380ad3-b0bd-3f6d-a105-19376ca543ed","vendor":{"name":"KubeVirt"}}],"enisaIdVulnerability":[{"id":"8bbb9ac9-ecf9-38a0-be7b-3140f5dabe74","vulnerability":{"id":"GHSA-46xp-26xh-hpqh","description":"KubeVirt Vulnerable to Arbitrary Host File Read and Write","datePublished":"Nov 7, 2025, 6:46:09 PM","dateUpdated":"Nov 27, 2025, 8:53:21 AM","baseScore":0.0,"references":"https://github.com/kubevirt/kubevirt/security/advisories/GHSA-46xp-26xh-hpqh\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-64324\nhttps://github.com/kubevirt/kubevirt/pull/15037\nhttps://github.com/kubevirt/kubevirt/commit/00d03e43e3bf03e563136695a4732b65ed42d764\nhttps://github.com/kubevirt/kubevirt/commit/ff3b69b08b6b9c8d08d23735ca8d82455f790a69\nhttps://github.com/kubevirt/kubevirt\n","enisa_id":"EUVD-2025-38316\n","aliases":"CVE-2025-64324\nGHSA-46xp-26xh-hpqh\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"c09eee4e-199f-3b7d-9659-6434356edaf9","vulnerability":{"id":"CVE-2025-64324","description":"KubeVirt is a virtual machine management add-on for Kubernetes. The `hostDisk` feature in KubeVirt allows mounting a host file or directory owned by the user with UID 107 into a VM. However, prior to version 1.6.1 and 1.7.0, the implementation of this feature and more specifically the `DiskOrCreate` option (which creates a file if it doesn\u0027t exist) has a logic bug that allows an attacker to read and write arbitrary files owned by more privileged users on the host system. Versions 1.6.1 and 1.7.0 fix the issue.","datePublished":"Nov 18, 2025, 10:10:19 PM","dateUpdated":"Feb 26, 2026, 4:21:07 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/kubevirt/kubevirt/security/advisories/GHSA-46xp-26xh-hpqh\nhttps://github.com/kubevirt/kubevirt/pull/15037\nhttps://github.com/kubevirt/kubevirt/commit/00d03e43e3bf03e563136695a4732b65ed42d764\nhttps://github.com/kubevirt/kubevirt/commit/ff3b69b08b6b9c8d08d23735ca8d82455f790a69\n","enisa_id":"EUVD-2025-38316\n","assigner":"GitHub_M","epss":0.24,"dataProcessed":"Nov 4, 2026, 7:19:47 AM","vulnerabilityProduct":[{"id":"350628f2-9c54-3456-be49-794504270ab2","product":{"name":"kubevirt","vendor":{"name":"KubeVirt"}},"product_version":"0 \u003c1.6.1"},{"id":"432467db-fba5-39ce-8c6f-705619677f05","product":{"name":"kubevirt","vendor":{"name":"KubeVirt"}},"product_version":"1.7.0-alpha.0 \u003c1.7.0-rc.0"}],"vulnerabilityVendor":[{"id":"d731c69b-2a46-345a-ad14-89a7ecc21bf7","vendor":{"name":"KubeVirt"}}]}}],"enisaIdAdvisory":[{"id":"2bfc1c0c-7233-3b25-b5a1-b736265eac0e","advisory":{"id":"openSUSE-SU-2026:20281-1","description":"Security update for kubevirt","summary":"Security update for kubevirt","datePublished":"Feb 27, 2026, 8:51:11 AM","dateUpdated":"Sep 17, 2026, 5:27:34 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20281-1.json\nhttps://bugzilla.suse.com/1241772\nhttps://bugzilla.suse.com/1253181\nhttps://bugzilla.suse.com/1253185\nhttps://bugzilla.suse.com/1253186\nhttps://bugzilla.suse.com/1253189\nhttps://bugzilla.suse.com/1253194\nhttps://bugzilla.suse.com/1253748\nhttps://bugzilla.suse.com/1257128\nhttps://bugzilla.suse.com/1257422\nhttps://www.suse.com/security/cve/CVE-2024-45310/\nhttps://www.suse.com/security/cve/CVE-2025-22872/\nhttps://www.suse.com/security/cve/CVE-2025-64324/\nhttps://www.suse.com/security/cve/CVE-2025-64432/\nhttps://www.suse.com/security/cve/CVE-2025-64433/\nhttps://www.suse.com/security/cve/CVE-2025-64434/\nhttps://www.suse.com/security/cve/CVE-2025-64435/\nhttps://www.suse.com/security/cve/CVE-2025-64437/\n","aliases":"CVE-2024-45310\nCVE-2025-22872\nCVE-2025-64324\nCVE-2025-64432\nCVE-2025-64433\nCVE-2025-64434\nCVE-2025-64435\nCVE-2025-64437\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"002dd427-323e-38b2-9ae9-434b36470c27","product":{"name":"kubevirt-virtctl-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"0273d30c-532a-36a0-8bcf-78a112467c7e","product":{"name":"kubevirt-sidecar-shim-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"060f9b51-b200-36c6-8b7c-3badbe54f973","product":{"name":"kubevirt-virt-exportserver-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"0a3c2215-b2f4-3e8f-8618-8d4dc6907ee1","product":{"name":"kubevirt-virt-synchronization-controller-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"0dd0905e-ca85-3dc8-857b-bc301b7fd554","product":{"name":"kubevirt-virt-exportproxy-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"15f463f0-3ddf-335a-a619-b9d93ac025a2","product":{"name":"kubevirt-virt-synchronization-controller-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"17130db5-07c7-36a8-9ea9-d117a43efcf2","product":{"name":"kubevirt-virt-launcher-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"1a867818-962f-33f3-86ed-8382e91f5349","product":{"name":"kubevirt-tests-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"1e5a8a23-98f1-3237-baae-85039fe8c38b","product":{"name":"kubevirt-virt-operator-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"1e6d59cf-5182-3839-84f5-d5b5ce2fcd4d","product":{"name":"kubevirt-container-disk-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"287f7a91-5bd1-3219-9880-44979222aa3e","product":{"name":"kubevirt-virtctl-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"2ac40a43-9cd1-3402-aad4-818e9b5ef779","product":{"name":"kubevirt-virt-exportserver-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"2acc5647-c9d8-34b0-a244-77fdb384d0cc","product":{"name":"kubevirt-manifests-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"2caef036-dde0-36ed-9167-eeb4bb3eb848","product":{"name":"openSUSE Leap 16.0","vendor":{"name":"SUSE"}}},{"id":"3f1defe7-747b-36b0-a8cd-f3f326c44c8b","product":{"name":"kubevirt-container-disk-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"4362a0b6-6998-3f73-8f62-6e580bfd8ac0","product":{"name":"obs-service-kubevirt_containers_meta-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"44c205f9-84f9-3f32-b953-acb3fcbe83ce","product":{"name":"kubevirt-virt-operator-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"44f0072e-1df0-3861-9f5b-8db160bdf49b","product":{"name":"kubevirt-pr-helper-conf-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"454f1b46-70fd-383b-80ad-2f5cfb38e78f","product":{"name":"kubevirt-tests-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"45ff23c4-7bce-33fc-8746-40a1a4308ed8","product":{"name":"obs-service-kubevirt_containers_meta-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"48f5133a-63c3-37b2-8ac7-ee7e8011e68e","product":{"name":"kubevirt-virt-exportserver-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"4c81372b-f489-31f9-a54f-c20106527222","product":{"name":"kubevirt-manifests-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"4ce478c2-6eca-3ce7-9d73-7a8bee2587b0","product":{"name":"kubevirt-virt-api-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"4f87a35b-bf91-3590-b841-201953de71f9","product":{"name":"kubevirt-virt-controller-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"517b0b11-28e5-35fe-87b5-55b5b6beb2f0","product":{"name":"kubevirt-virt-api-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"61087ddc-2600-3075-a38c-3daff3aa4fde","product":{"name":"kubevirt-virt-api-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6256de49-6ea7-3f5c-936f-3398960a4fde","product":{"name":"kubevirt-virt-operator-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"6ad8dee4-705a-3d93-9e21-a3f053459a6f","product":{"name":"kubevirt-virt-synchronization-controller-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6f161148-99ba-3a13-9974-3a177f8dfef5","product":{"name":"kubevirt-virt-launcher-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"70d44f1b-9643-3a05-8e9e-99899463bd10","product":{"name":"kubevirt-virt-handler-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"748f3398-123b-36f4-a45a-ff2e2a909c13","product":{"name":"kubevirt-virt-synchronization-controller-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"788a963e-411d-3c1c-bfe3-3670341ea210","product":{"name":"kubevirt-virt-operator-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"7a3744e3-2d27-3b0e-98fe-71de37f64c26","product":{"name":"kubevirt-virt-api-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7b7a1109-5a8b-3c5c-9f01-6aab63d0dea7","product":{"name":"kubevirt-virt-controller-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"7fd04a9b-ab54-3581-b08a-5686bcb11db6","product":{"name":"kubevirt-virt-handler-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"82823390-923a-3ab4-9b5c-1e909f872ef9","product":{"name":"kubevirt-container-disk-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"85217932-9e71-323f-b69c-455845e8f31e","product":{"name":"kubevirt-virt-controller-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"860f9a63-051a-37e2-9102-be546be3ca23","product":{"name":"kubevirt-virt-handler-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"8672d0d6-46f7-38db-aad1-21dfed5f9b0e","product":{"name":"obs-service-kubevirt_containers_meta-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"914665da-e970-3c08-8626-ce5a6dc529c2","product":{"name":"kubevirt-sidecar-shim-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"917b6993-7cdb-3590-bb6b-58aa99e8e0f1","product":{"name":"kubevirt-tests-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"92faebda-9ee9-330c-8b4e-0435806c2b2d","product":{"name":"kubevirt-virt-exportproxy-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"a56d6093-cba1-39f6-93ac-fc0f798767c0","product":{"name":"obs-service-kubevirt_containers_meta-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"a6d885f6-8a94-371a-9121-2e11f5c5133f","product":{"name":"kubevirt-sidecar-shim-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"a7a134d2-8e93-35c2-94a9-3de5757f15dd","product":{"name":"kubevirt-sidecar-shim-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"ad4afd5f-ba4d-3374-ab72-78174f0751ab","product":{"name":"kubevirt-pr-helper-conf-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"af00f1d1-21d8-3e03-8ba1-2764bdbdb13f","product":{"name":"kubevirt-virt-exportserver-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"b1b6022c-0173-3d4f-a5ed-2972f9d7ad46","product":{"name":"kubevirt-virtctl-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"b8134be8-1dad-3392-8250-0b3b47829c3a","product":{"name":"kubevirt-virt-launcher-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"c00cc73f-d213-3582-acc1-023a868ab00c","product":{"name":"kubevirt-virt-exportproxy-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"c4b20474-72f3-385e-a779-70d62ec6acbf","product":{"name":"kubevirt-virt-launcher-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"c8b4a878-12d8-319d-be38-f121ee002d30","product":{"name":"kubevirt-pr-helper-conf-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"d030a8b5-16fd-375b-8efe-d9d248fd3919","product":{"name":"kubevirt-virt-handler-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"d1027259-80e2-3510-a510-9ad097085cee","product":{"name":"kubevirt-tests-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"d505b1a9-2a80-3b2d-9539-063eca8b7180","product":{"name":"kubevirt-container-disk-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"d8413085-2b47-348c-9daf-4658267dff59","product":{"name":"kubevirt-manifests-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"f1e77fc3-a09b-3c4c-a6ee-0f9a92454653","product":{"name":"kubevirt-pr-helper-conf-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"f553f227-69e8-393b-80c6-5e39620f47de","product":{"name":"kubevirt-virtctl-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"fb6dc738-2fbc-3f54-8d60-ea93146724a9","product":{"name":"kubevirt-manifests-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"fd5efa7d-72bb-30ee-a810-d2ffd4d96b21","product":{"name":"kubevirt-virt-controller-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"ff962649-2387-3af2-aadd-fa8a820c3a2e","product":{"name":"kubevirt-virt-exportproxy-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}}]}},{"id":"393bb403-56ce-35ed-976f-02d3c8f1abc4","advisory":{"id":"SUSE-SU-2026:20551-1","description":"Security update for kubevirt","summary":"Security update for kubevirt","datePublished":"Feb 27, 2026, 8:51:11 AM","dateUpdated":"Oct 15, 2026, 5:04:44 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20551-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202620551-1/\nhttps://lists.suse.com/pipermail/sle-updates/2026-March/044565.html\nhttps://bugzilla.suse.com/1241772\nhttps://bugzilla.suse.com/1253181\nhttps://bugzilla.suse.com/1253185\nhttps://bugzilla.suse.com/1253186\nhttps://bugzilla.suse.com/1253189\nhttps://bugzilla.suse.com/1253194\nhttps://bugzilla.suse.com/1253748\nhttps://bugzilla.suse.com/1257128\nhttps://bugzilla.suse.com/1257422\nhttps://www.suse.com/security/cve/CVE-2024-45310/\nhttps://www.suse.com/security/cve/CVE-2025-22872/\nhttps://www.suse.com/security/cve/CVE-2025-64324/\nhttps://www.suse.com/security/cve/CVE-2025-64432/\nhttps://www.suse.com/security/cve/CVE-2025-64433/\nhttps://www.suse.com/security/cve/CVE-2025-64434/\nhttps://www.suse.com/security/cve/CVE-2025-64435/\nhttps://www.suse.com/security/cve/CVE-2025-64437/\n","aliases":"CVE-2024-45310\nCVE-2025-22872\nCVE-2025-64324\nCVE-2025-64432\nCVE-2025-64433\nCVE-2025-64434\nCVE-2025-64435\nCVE-2025-64437\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"047ab7be-e4fe-32f7-9f44-6b6577618732","product":{"name":"kubevirt-virtctl-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"0fc1dc77-3397-3dac-a3c6-2415c5b28d51","product":{"name":"kubevirt-virtctl-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"2a7ed871-dcb5-359d-9eee-6bdb5bf3402b","product":{"name":"kubevirt-manifests-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"5f657d07-e55d-36e5-87b3-fc0329df67db","product":{"name":"kubevirt-manifests-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"74179afd-f113-3c9b-bed9-50b1414c5482","product":{"name":"kubevirt-virtctl-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"8d629319-6e2b-3b68-b8e6-be5705fd7e37","product":{"name":"SUSE Linux Micro 6.2","vendor":{"name":"SUSE"}}},{"id":"be16e5ab-d123-31da-83af-8d62693c0837","product":{"name":"kubevirt-manifests-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"d40ce914-bd5b-3480-a565-9a32ff69642c","product":{"name":"kubevirt-virtctl-0:1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"fa2e8baa-b58e-34da-b031-e3ad31fb004a","product":{"name":"kubevirt-manifests-0:1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}}]}},{"id":"396f2024-9972-378b-a509-cd12edc5216c","advisory":{"id":"SUSE-SU-2026:20571-1","description":"Security update for kubevirt","summary":"Security update for kubevirt","datePublished":"Feb 27, 2026, 8:49:48 AM","dateUpdated":"Sep 16, 2026, 7:33:00 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20571-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202620571-1/\nhttps://lists.suse.com/pipermail/sle-security-updates/2026-March/024573.html\nhttps://bugzilla.suse.com/1241772\nhttps://bugzilla.suse.com/1253181\nhttps://bugzilla.suse.com/1253185\nhttps://bugzilla.suse.com/1253186\nhttps://bugzilla.suse.com/1253189\nhttps://bugzilla.suse.com/1253194\nhttps://bugzilla.suse.com/1253748\nhttps://bugzilla.suse.com/1257128\nhttps://bugzilla.suse.com/1257422\nhttps://www.suse.com/security/cve/CVE-2024-45310/\nhttps://www.suse.com/security/cve/CVE-2025-22872/\nhttps://www.suse.com/security/cve/CVE-2025-64324/\nhttps://www.suse.com/security/cve/CVE-2025-64432/\nhttps://www.suse.com/security/cve/CVE-2025-64433/\nhttps://www.suse.com/security/cve/CVE-2025-64434/\nhttps://www.suse.com/security/cve/CVE-2025-64435/\nhttps://www.suse.com/security/cve/CVE-2025-64437/\n","aliases":"CVE-2024-45310\nCVE-2025-22872\nCVE-2025-64324\nCVE-2025-64432\nCVE-2025-64433\nCVE-2025-64434\nCVE-2025-64435\nCVE-2025-64437\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"367be85a-2d01-35f0-89e1-ae2d01db687c","product":{"name":"SUSE Linux Micro Extras 6.2","vendor":{"name":"SUSE"}}},{"id":"53961a03-fede-369f-8a04-d3020bfb24c3","product":{"name":"kubevirt-tests-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}}]}},{"id":"73f45a3d-6b8c-359f-9194-233a183f9f97","advisory":{"id":"SUSE-SU-2026:20610-1","description":"Security update for kubevirt","summary":"Security update for kubevirt","datePublished":"Feb 27, 2026, 8:49:48 AM","dateUpdated":"Sep 16, 2026, 7:33:21 PM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20610-1.json\nhttps://www.suse.com/support/update/announcement/2026/suse-su-202620610-1/\nhttps://lists.suse.com/pipermail/sle-security-updates/2026-March/024607.html\nhttps://bugzilla.suse.com/1241772\nhttps://bugzilla.suse.com/1253181\nhttps://bugzilla.suse.com/1253185\nhttps://bugzilla.suse.com/1253186\nhttps://bugzilla.suse.com/1253189\nhttps://bugzilla.suse.com/1253194\nhttps://bugzilla.suse.com/1253748\nhttps://bugzilla.suse.com/1257128\nhttps://bugzilla.suse.com/1257422\nhttps://www.suse.com/security/cve/CVE-2024-45310/\nhttps://www.suse.com/security/cve/CVE-2025-22872/\nhttps://www.suse.com/security/cve/CVE-2025-64324/\nhttps://www.suse.com/security/cve/CVE-2025-64432/\nhttps://www.suse.com/security/cve/CVE-2025-64433/\nhttps://www.suse.com/security/cve/CVE-2025-64434/\nhttps://www.suse.com/security/cve/CVE-2025-64435/\nhttps://www.suse.com/security/cve/CVE-2025-64437/\n","aliases":"CVE-2024-45310\nCVE-2025-22872\nCVE-2025-64324\nCVE-2025-64432\nCVE-2025-64433\nCVE-2025-64434\nCVE-2025-64435\nCVE-2025-64437\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"3bcaa38c-bbe0-3990-985f-ac9d355e1e32","product":{"name":"kubevirt-virtctl-1.7.0-160000.1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"3c369a88-3894-389d-9068-85238b27ba68","product":{"name":"kubevirt-virtctl-1.7.0-160000.1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"5fbc24f3-9ae3-3423-b95d-9b3556732770","product":{"name":"SUSE Linux Enterprise Server 16.0","vendor":{"name":"SUSE"}}},{"id":"63c6f5a8-e0e1-36fe-9283-2bd4a50cd211","product":{"name":"SUSE Linux Enterprise Server for SAP applications 16.0","vendor":{"name":"SUSE"}}}]}},{"id":"cdda7d37-7613-3559-b4d4-73eb49df9909","advisory":{"id":"msrc_CVE-2025-64324","description":"KubeVirt Vulnerable to Arbitrary Host File Read and Write","datePublished":"Nov 2, 2025, 12:00:00 AM","dateUpdated":"Dec 17, 2025, 2:35:11 PM","baseScore":0.0,"references":"https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-64324.json\n","aliases":"CVE-2025-64324\n","source":{"id":20,"name":"csaf_microsoft"},"advisoryProduct":[{"id":"58b5a82f-cfa4-33cf-9130-8446fbc06563","product":{"name":"azl3 kubevirt 1.5.3-2","vendor":{"name":"Microsoft"}}},{"id":"590ed6bb-1590-3db3-875b-2e19a0ca78a0","product":{"name":"kubevirt","vendor":{"name":"KubeVirt"}}},{"id":"62bbe604-e2d2-3300-a8dc-ae7598a4309e","product":{"name":"3.0","vendor":{"name":"Wind River"}}},{"id":"8bbacaf6-c74c-371e-957a-81de11a21465","product":{"name":"\u003ccbl2 kubevirt 0.59.0-30","vendor":{"name":"Microsoft"}}},{"id":"c0a8cf52-1ff2-3e34-8b60-c7f2cd5fcfcd","product":{"name":"\u003cazl3 kubevirt 1.5.3-2","vendor":{"name":"Microsoft"}}},{"id":"dde2e89b-cb22-3255-a10b-e6f5c6581c45","product":{"name":"Azure Linux","vendor":{"name":"Microsoft"}}},{"id":"e6490b6b-d992-3161-b634-45bbb517ee24","product":{"name":"2.0","vendor":{"name":"Smiths Medical"}}},{"id":"ed37a815-007d-3fab-a73a-564edb8b3bd2","product":{"name":"cbl2 kubevirt 0.59.0-30","vendor":{"name":"Microsoft"}}},{"id":"f1db503d-bc32-304e-a811-6798714f075c","product":{"name":"azl3 kubevirt 1.5.0-5","vendor":{"name":"Microsoft"}}}]}},{"id":"fde0b493-afb7-37a9-b078-3295ceb91768","advisory":{"id":"SUSE-SU-2025:4330-1","description":"Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container","summary":"Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container","datePublished":"Dec 9, 2025, 11:33:55 AM","dateUpdated":"Dec 9, 2025, 11:33:55 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_4330-1.json\nhttps://www.suse.com/support/update/announcement/2025/suse-su-20254330-1/\nhttps://lists.suse.com/pipermail/sle-security-updates/2025-December/023449.html\nhttps://bugzilla.suse.com/1241772\nhttps://bugzilla.suse.com/1250683\nhttps://bugzilla.suse.com/1253181\nhttps://bugzilla.suse.com/1253185\nhttps://bugzilla.suse.com/1253186\nhttps://bugzilla.suse.com/1253194\nhttps://bugzilla.suse.com/1253384\nhttps://bugzilla.suse.com/1253748\nhttps://www.suse.com/security/cve/CVE-2025-22872/\nhttps://www.suse.com/security/cve/CVE-2025-64324/\nhttps://www.suse.com/security/cve/CVE-2025-64432/\nhttps://www.suse.com/security/cve/CVE-2025-64433/\nhttps://www.suse.com/security/cve/CVE-2025-64434/\nhttps://www.suse.com/security/cve/CVE-2025-64437/\n","aliases":"CVE-2025-22872\nCVE-2025-64324\nCVE-2025-64432\nCVE-2025-64433\nCVE-2025-64434\nCVE-2025-64437\n","source":{"id":22,"name":"csaf_suse"},"advisoryProduct":[{"id":"0a976811-e721-34c9-a06a-fd5fb3c1fbdd","product":{"name":"kubevirt-container-disk-1.6.3-150700.3.13.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"166531df-0e2e-3226-b5cc-ee581ac1e23e","product":{"name":"obs-service-kubevirt_containers_meta-1.6.3-150700.3.13.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"1f06a57f-8ec6-3ebd-84a8-1b83506a54fd","product":{"name":"kubevirt-virt-operator-1.6.3-150700.3.13.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"204482cf-475e-3bce-a5bc-9d87822d46ca","product":{"name":"kubevirt-virt-exportserver-1.6.3-150700.3.13.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"2e1c1c2b-08bf-3244-922c-c18ec77bc9c0","product":{"name":"kubevirt-tests-1.6.3-150700.3.13.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"31004b7e-8bd2-37a5-883f-3fd036b01df2","product":{"name":"kubevirt-virtctl-1.6.3-150700.3.13.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"32ffde05-8676-34fd-9f40-40a5a0443c91","product":{"name":"kubevirt-virt-controller-1.6.3-150700.3.13.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"52e7b261-88d3-39ba-831f-f275c4893511","product":{"name":"kubevirt-container-disk-1.6.3-150700.3.13.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"57ecace8-5027-3276-8adb-36bbbcbda941","product":{"name":"kubevirt-virt-synchronization-controller-1.6.3-150700.3.13.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"614bc4c7-be4a-30e2-91f7-0c0dd4816d38","product":{"name":"SUSE Linux Enterprise Module for Containers 15 SP7","vendor":{"name":"SUSE"}}},{"id":"668a4326-c758-37ee-a84e-2c7003e8288b","product":{"name":"kubevirt-manifests-1.6.3-150700.3.13.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"6740871f-e957-3d75-a1f3-61f4d90b2a99","product":{"name":"kubevirt-virt-api-1.6.3-150700.3.13.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"68c2e9f6-973b-3e08-b27d-d7b65b26d578","product":{"name":"kubevirt-virt-synchronization-controller-1.6.3-150700.3.13.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"6a5b0beb-1d2c-3de7-89c0-87df609471bd","product":{"name":"kubevirt-pr-helper-conf-1.6.3-150700.3.13.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"724d5f16-f035-35da-bf19-77405d198fa9","product":{"name":"kubevirt-virt-launcher-1.6.3-150700.3.13.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"803116fa-ed92-3e29-9555-937a57c9cd7b","product":{"name":"kubevirt-virt-exportproxy-1.6.3-150700.3.13.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"8e4ea0d3-6a06-3f9d-bd2d-ed2f2df443ec","product":{"name":"kubevirt-manifests-1.6.3-150700.3.13.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"9179f81b-a069-32c0-b9eb-9ddfac1e0348","product":{"name":"obs-service-kubevirt_containers_meta-1.6.3-150700.3.13.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"aa9205cf-81e8-3cb3-bfbc-d61ccfb10bfd","product":{"name":"kubevirt-virtctl-1.6.3-150700.3.13.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"aaa2621a-12ce-3707-82d5-122a49882239","product":{"name":"kubevirt-tests-1.6.3-150700.3.13.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"b51851c9-9364-3bfe-b9bb-2fab6d809bc2","product":{"name":"kubevirt-virt-operator-1.6.3-150700.3.13.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"bad15dbe-803a-3604-8a33-9b207da808ed","product":{"name":"kubevirt-virt-exportproxy-1.6.3-150700.3.13.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"bf931252-1065-3044-b8fc-96d1c24438cd","product":{"name":"kubevirt-virt-handler-1.6.3-150700.3.13.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"c84fbfbb-883e-3693-b427-dfaf520d9da5","product":{"name":"kubevirt-virt-api-1.6.3-150700.3.13.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"cae9f55a-f568-3cc3-8fb6-466a69e92f91","product":{"name":"kubevirt-virt-handler-1.6.3-150700.3.13.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"e7f2759f-661d-3c24-acd3-4b4d46405469","product":{"name":"kubevirt-virt-controller-1.6.3-150700.3.13.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"f00ebad2-8112-383f-8d71-50be37d976ff","product":{"name":"kubevirt-pr-helper-conf-1.6.3-150700.3.13.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"f76e0e3a-6134-3191-bc7d-7ae284e67f22","product":{"name":"kubevirt-virt-launcher-1.6.3-150700.3.13.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"fab62685-e52d-32ad-9a03-3a5cc29a116e","product":{"name":"kubevirt-virt-exportserver-1.6.3-150700.3.13.1.x86_64","vendor":{"name":"SUSE"}}}]}}]}