AZL-95613

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-95613.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-95613

Upstream

CVE-2026-63623

Published

2026-08-10T17:17:35Z

Modified

2026-09-20T05:33:47Z

Summary

CVE-2026-63623 affecting package libvirt for versions less than 11.9.0-1

Details

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-63623

Affected packages

Azure Linux:3 / libvirt

Package

Name: libvirt
Purl: pkg:rpm/azure-linux/libvirt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

11.9.0-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-95613.json"