CVE-2025-64437

CVE-2025-64437 is a symlink vulnerability in KubeVirt, affecting versions prior to 1.5.3 and 1.6.1. The virt-handler component fails to validate the launcher-sock, allowing an attacker with control over the virt-launcher pod's filesystem to change arbitrary host file ownership to an unprivileged user, compromising host data confidentiality, integrity, and availability. This vulnerability has a CVSS score of 5.0 (Medium) with a local attack vector and high attack complexity, requiring prior compromise of the virt-launcher pod. There is no known active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or KEV listing, though it has received limited community discussion and media coverage.