CVE-2023-32684

CVE-2023-32684 is a low-severity vulnerability affecting Lima, a tool for running Linux virtual machines, primarily on macOS. Prior to version 0.16.0, a malicious disk image within a Lima VM could read a single host filesystem file, even without a mounted host filesystem. Exploitation requires an attacker to embed a target file path in a malicious disk image, making it a complex attack with limited impact, as Lima does not run as root and cannot read entire disks. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.