Local Privilege Escalation in QEMU Guest Agent by QEMU
CVE-2026-12080
7.3HIGH
What is CVE-2026-12080?
A vulnerability exists in the QEMU Guest Agent that allows local unprivileged users to exploit the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. By using techniques such as a deterministic directory-symlink bypass or engaging in a Time-of-Check to Time-of-Use (TOCTOU) race condition, an attacker could gain ownership of arbitrary root-owned files or directories. This exploitation scenario necessitates an external management layer, like libvirt, to activate the vulnerable code path, potentially leading to unauthorized root access.
References
CVSS V3.1
Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Valentino Paulon for reporting this issue.