CVE-2025-12748 Libvirt: denial of service in xml parsing
A malicious user can cause a denial of service in libvirt by submitting crafted XML files that trigger excessive memory allocation before ACL checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-12748?
CVE-2025-12748 is a medium-severity denial of service vulnerability in Red Hat Enterprise Linux 10, published on 11 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.
Weakness: CWE-770
Which versions are affected by CVE-2025-12748?
Linux distribution packages (40)
libvirt AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-client AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-client-qemu AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-common AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-config-network AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-config-nwfilter AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-driver-interface AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-driver-network AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-driver-nodedev AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-driver-nwfilter AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-driver-qemu AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-driver-secret AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-driver-storage AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-driver-storage-core AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-driver-storage-disk AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-driver-storage-iscsi AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-driver-storage-logical AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-driver-storage-mpath AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-driver-storage-rbd AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-driver-storage-scsi AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-kvm AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-lock AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-log AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-plugin-lockd AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-plugin-sanlock AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-daemon-proxy AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-devel AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-docs AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-libs AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-nss AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt-ssh-proxy AlmaLinux:10 | All versions | 11.10.0-12.el10_2.alma.1 |
libvirt AlmaLinux:9 | All versions | 11.10.0-12.el9_8.alma.1 |
libvirt-client AlmaLinux:9 | All versions | 11.10.0-12.el9_8.alma.1 |
libvirt-client-qemu AlmaLinux:9 | All versions | 11.10.0-12.el9_8.alma.1 |
libvirt-daemon AlmaLinux:9 | All versions | 11.10.0-12.el9_8.alma.1 |
libvirt-daemon-common AlmaLinux:9 | All versions | 11.10.0-12.el9_8.alma.1 |
libvirt-daemon-config-network AlmaLinux:9 | All versions | 11.10.0-12.el9_8.alma.1 |
libvirt-daemon-config-nwfilter AlmaLinux:9 | All versions | 11.10.0-12.el9_8.alma.1 |
libvirt-daemon-driver-interface AlmaLinux:9 | All versions | 11.10.0-12.el9_8.alma.1 |
How do I fix CVE-2025-12748?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-12748 being exploited?
There is no known exploitation of CVE-2025-12748 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as ALSA-2026:18326, ALSA-2026:18748, AZL-70187, AZL-70199, BELL-CVE-2025-12748, CLSA-2026-1779709803 and 13 more.