CVE-2026-63623 in Red Hat
Summary
by MITRE • 08/10/2026
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability exists within the libvirt virtualization management library where storage volume clone or convert operations create temporary files with insufficient permission settings. The flaw specifically affects the qemu-img utility which is responsible for creating and managing virtual disk images in virtualized environments. During these operations, newly created volume images are inadvertently created with world-readable permissions, meaning any local user on the system can access the full contents of guest virtual machine disks.
The technical root cause stems from improper file creation handling within the qemu-img utility where default umask settings or explicit permission flags do not adequately restrict access to temporary storage files. This represents a classic case of insufficient privilege separation and inadequate access control enforcement in virtualization infrastructure components. The vulnerability manifests when libvirt executes storage operations that involve creating new disk images, particularly during cloning or conversion processes where intermediate files must be created before finalizing the operation.
The operational impact of this vulnerability is significant for virtualized environments as it enables unauthorized local users to directly access sensitive guest operating system data, including user credentials, application data, configuration files, and potentially entire system states. This information disclosure threat extends beyond simple file reading to encompass complete guest disk contents, which may include encrypted volumes, database contents, or other confidential information stored within virtual machines. The vulnerability affects systems where libvirt manages virtualization workloads and where local users might exist on the same host system as the virtual machines.
Security standards such as CWE-276 identify this as a permissions flaw related to improper file access control, while ATT&CK framework category T1005 covers data from local system collection. Organizations running virtualized environments using libvirt are particularly vulnerable since the flaw exists at the storage management layer where virtual machine disk images are handled. The threat is especially concerning in multi-tenant environments or shared hosting scenarios where different users might have access to the same physical host.
Mitigation strategies should focus on immediate patching of libvirt and qemu-img components to ensure proper file permission handling during storage operations. System administrators should also implement monitoring for unusual file access patterns on virtual disk images and consider implementing additional access controls through SELinux or AppArmor policies. The remediation process requires updating to patched versions of libvirt where the default umask settings or explicit permission handling has been corrected to prevent world-readable temporary files. Additionally, organizations should review their virtualization infrastructure configurations and implement principle of least privilege for virtual machine storage operations to minimize potential exposure from similar permission-related vulnerabilities.