Libvirt is a virtualization management library embedded across a wide range of hypervisor platforms and cloud infrastructure, giving its vulnerability footprint significance despite a narrow product focus. Its disclosures recur around memory-safety issues such as improper buffer-boundary enforcement and exposure of sensitive information, reflecting the low-level host-guest interaction complexity inherent to virtualization software, and frequently acquire public exploit code. Defenders should track this vendor's advisories closely for deployment in hypervisor and container-host environments; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Libvirt over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2009-0036MEDIUM Buffer overflow in the proxyReadClientSocket function in proxy/libvirt_proxy.c in libvirt_proxy 0.5.1 might allow local users to gain privileges by sending a portion of the header | Feb 11, 2009 | 4.4 | 24 | NO | YES |
CVE-2014-3633MEDIUM The qemuDomainGetBlockIoTune function in qemu/qemu_driver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the live image, allows remote attackers to cau | Oct 6, 2014 | 5.8 | 21 | NO | NO |
CVE-2015-5160MEDIUM libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a proces | Aug 20, 2018 | 5.5 | 20 | NO | NO |
CVE-2014-3657MEDIUM The virDomainListPopulate function in conf/domain_conf.c in libvirt before 1.2.9 does not clean up the lock on the list of domains, which allows remote attackers to cause a denial | Oct 6, 2014 | 5.0 | 19 | NO | NO |
CVE-2008-5086HIGH Multiple methods in libvirt 0.3.2 through 0.5.1 do not check if a connection is read-only, which allows local users to bypass intended access restrictions and perform administrativ | Dec 19, 2008 | 7.2 | 18 | NO | NO |
CVE-2010-2239MEDIUM Red Hat libvirt, possibly 0.6.0 through 0.8.2, creates new images without setting the user-defined backing-store format, which allows guest OS users to read arbitrary files on the | Aug 19, 2010 | 4.4 | 15 | NO | NO |
CVE-2010-2238MEDIUM Red Hat libvirt, possibly 0.7.2 through 0.8.2, recurses into disk-image backing stores without extracting the defined disk backing-store format, which might allow guest OS users to | Aug 19, 2010 | 4.4 | 15 | NO | NO |
CVE-2010-2237MEDIUM Red Hat libvirt, possibly 0.6.1 through 0.8.2, looks up disk backing stores without referring to the user-defined main disk format, which might allow guest OS users to read arbitra | Aug 19, 2010 | 4.4 | 15 | NO | NO |
Red Hat libvirt 0.2.0 through 0.8.2 creates iptables rules with improper mappings of privileged source ports, which allows guest OS users to bypass intended access restrictions by | Aug 19, 2010 | 2.1 | 12 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Libvirt.
Media articles that mention a CVE ID that affects a product developed by Libvirt — matched by CVE ID, not by vendor name.