AZL-95613

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-95613.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-95613

Upstream

CVE-2026-63623

Published

2026-08-10T17:17:35Z

Modified

2026-08-31T05:26:27Z

Summary

CVE-2026-63623 affecting package libvirt 10.10.0-2

Details

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-63623

Affected packages

Azure Linux:3 / libvirt

Package

Name: libvirt
Purl: pkg:rpm/azure-linux/libvirt

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

10.10.0-2

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-95613.json"