CVE-2025-64435 KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation

What is CVE-2025-64435?

CVE-2025-64435 is a medium-severity vulnerability in kubevirt, published on 7 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can mislead the virt-controller into associating the fake pod with the VMI, resulting in incorrect status updates and potentially causing a DoS (Denial-of-Service). This vulnerability is fixed in 1.7.0-beta.0.

Weakness: CWE-703

Which versions are affected by CVE-2025-64435?

3 open source packages ship an affected version, including kubevirt.io/kubevirt. It affects 1 product.

Products include Kubevirt Kubevirt.

How do I fix CVE-2025-64435?

Upgrade kubevirt.io/kubevirt to 1.7.0-beta.0 or later.

Is CVE-2025-64435 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-64435 exists.

Other vulnerabilities in kubevirt

• CVE-2020-14316 Privilege Escalation in kubevirt Critical 9.9
• CVE-2022-1798 Path Traversal vulnerability in Kubevirt High 8.7
• CVE-2025-64324 KubeVirt Vulnerable to Arbitrary Host File Read and Write High 8.5
• CVE-2023-26484 On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs High 8.2
• CVE-2026-13201 Path traversal in Red Hat Container Native Virtualization 4.12 High 7.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-69802, AZL-69964, GHSA-9m94-w2vq-hcf9, GO-2025-4105, MINI-g76c-6fqv-232h, MINI-q5w5-gxg8-3p46 and 2 more.