DEBIAN-CVE-2026-63623

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-63623
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-63623.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-63623
Upstream
  • CVE-2026-63623
Published
2026-08-10T17:17:35Z
Modified
2026-09-14T17:03:47Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.

References

Affected packages

Debian:12 / libvirt

Package

Name
libvirt
Purl
pkg:deb/debian/libvirt?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.0.0-4
9.0.0-4+deb12u1
9.0.0-4+deb12u2
9.1.0-1
9.2.0-1
9.2.0-2
9.3.0-1
9.3.0-2
9.4.0-1
9.5.0-1
9.5.0-2
9.6.0-1
9.6.0-2
9.6.0-3
9.7.0-1
9.8.0-1
9.8.0-2
9.9.0-1
9.10.0-1
10.*
10.0.0-1
10.0.0-2
10.0.0-3
10.1.0-1
10.2.0-1
10.3.0-1
10.3.0-2
10.3.0-3
10.4.0-1
10.5.0-1
10.6.0-1
10.6.0-2
10.6.0-3
10.7.0-1
10.7.0-2
10.7.0-3
10.8.0-1
10.9.0-1
10.9.0-2
10.10.0-1
10.10.0-2
10.10.0-3
10.10.0-4
11.*
11.0.0-1
11.0.0-2
11.1.0-1
11.1.0-2
11.2.0-1
11.2.0-2
11.2.0-3
11.3.0-1
11.3.0-2~bpo12+1
11.3.0-2
11.3.0-3
11.4.0-1
11.5.0-1
11.6.0-1
11.7.0-1
11.8.0-1
11.8.0-2
11.9.0-1
11.9.0-2
11.10.0-1
11.10.0-2
12.*
12.0.0-1
12.1.0-1
12.2.0-1
12.3.0-1
12.4.0-1
12.5.0-1
12.6.0-1
12.7.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-63623.json"

Debian:13 / libvirt

Package

Name
libvirt
Purl
pkg:deb/debian/libvirt?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
11.3.0-3+deb13u3

Affected versions

11.*
11.3.0-3
11.3.0-3+deb13u1
11.3.0-3+deb13u2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-63623.json"

Debian:14 / libvirt

Package

Name
libvirt
Purl
pkg:deb/debian/libvirt?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
12.6.0-1

Affected versions

11.*
11.3.0-3
11.4.0-1
11.5.0-1
11.6.0-1
11.7.0-1
11.8.0-1
11.8.0-2
11.9.0-1
11.9.0-2
11.10.0-1
11.10.0-2
12.*
12.0.0-1
12.1.0-1
12.2.0-1
12.3.0-1
12.4.0-1
12.5.0-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-63623.json"