OpenStack Nova up to 30.2.1/31.2.0/32.1.0 qemu-img stack-based overflow

Summaryinfo

A vulnerability identified as critical has been detected in OpenStack Nova up to 30.2.1/31.2.0/32.1.0. This vulnerability affects unknown code of the component qemu-img. This manipulation causes stack-based overflow. This vulnerability is tracked as CVE-2026-24708. No exploit exists. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in OpenStack Nova up to 30.2.1/31.2.0/32.1.0. It has been declared as critical. Affected by this vulnerability is some unknown functionality of the component qemu-img. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.

It is possible to read the advisory at seclists.org. This vulnerability is known as CVE-2026-24708. The exploitation appears to be easy. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 299348 (Linux Distros Unpatched Vulnerability : CVE-2026-24708), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 30.2.2, 32.1.1 or 31.2.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (299348). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• OpenStack

Name

• Nova

Version

• 30.2.0
• 30.2.1
• 31.0
• 31.1
• 31.2.0
• 32.0
• 32.1.0

License

• free

Website

• Vendor: https://www.openstack.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion