Denial-of-Service Vulnerability in libvirt XML File Processing by Red Hat

CVE-2025-12748

What is CVE-2025-12748?

A vulnerability in libvirt's handling of XML file processing has been identified, allowing malicious users with limited permissions to exploit the system. The flaw occurs because user-provided XML files are parsed before the necessary Access Control List (ACL) checks are completed. An attacker could craft a specifically designed XML file that, when processed, causes excessive memory allocation on the host system. This can lead to the libvirt process crashing, resulting in a denial-of-service condition that could disrupt services reliant on libvirt.

References