CVE-2025-14525 Kubevirt: kubevirt: vm administration denial of service via guest agent
A VM user can cause a denial of service for administrative operations by overwhelming the system with excessive network interface reports via the guest agent.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-14525?
CVE-2025-14525 is a medium-severity denial of service vulnerability in Red Hat OpenShift Virtualization 4, published on 26 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in kubevirt. A user within a virtual machine (VM), if the guest agent is active, can exploit this by causing the agent to report an excessive number of network interfaces. This action can overwhelm the system's ability to store VM configuration updates, effectively blocking changes to the Virtual Machine Instance (VMI). This allows the VM user to restrict the VM administrator's ability to manage the VM, leading to a denial of service for administrative operations.
Weakness: CWE-770
Which versions are affected by CVE-2025-14525?
3 open source packages ship an affected version, including kubevirt.io/kubevirt.
| Package | Affected | Fixed in |
|---|---|---|
kubevirt.io/kubevirt Go | All versions | None |
kubevirt.io/kubevirt Go | All versions to 1.7.0 | None |
kubevirt.io/kubevirt Go | All versions to 1.7.0 | None |
How do I fix CVE-2025-14525?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-14525 being exploited?
There is no known exploitation of CVE-2025-14525 in the wild and no public exploit code.
Sources
Also known as GHSA-25mh-hp8x-cgrv, GO-2026-4384, MINI-47c8-4vrq-jjr5, MINI-49p5-gmc9-3hp2, MINI-v8vh-5j4g-c3mg, MINI-vg57-g7rv-gp6m.