CVE-2025-14946
Full vulnerability record from the local CVENow database.
Description
A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.
Severity
MEDIUM
CVSS score
4.8
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2025-12-19 13:16:03.127000
Last modified
2026-11-05 15:17:12.163000
View original CVE JSON
{
"id": "CVE-2025-14946",
"sourceIdentifier": "[email protected]",
"published": "2025-12-19T13:16:03.127",
"lastModified": "2026-11-05T15:17:12.163",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd."
},
{
"lang": "es",
"value": "Se encontró una falla en libnbd. Un actor malicioso podría explotar esto al convencer a libnbd de abrir un Identificador Uniforme de Recursos (URI) especialmente diseñado. Esta vulnerabilidad surge porque los nombres de host no estándar que comienzan con '-o' se interpretan incorrectamente como argumentos para el proceso de Secure Shell (SSH), en lugar de como nombres de host. Esto podría conducir a la ejecución de código arbitrario con los privilegios del usuario que ejecuta libnbd."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "libnbd",
"defaultStatus": "unaffected",
"collectionURL": "https://gitlab.com/nbdkit/libnbd",
"packageName": "libnbd",
"versions": [
{
"version": "1.22.0",
"lessThan": "1.22.5",
"versionType": "semver",
"status": "affected"
},
{
"version": "1.23.0",
"lessThan": "1.23.9",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libnbd",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "virt:rhel/libnbd",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libnbd",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-cdi-apiserver",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-cdi-apiserver-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-cdi-cloner",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-cdi-cloner-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-cdi-controller",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-cdi-controller-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-cdi-importer",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-cdi-importer-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-cdi-operator",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-cdi-operator-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-cdi-uploadproxy",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-cdi-uploadproxy-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-cdi-uploadserver",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift Virtualization 4",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "container-native-virtualization/virt-cdi-uploadserver-rhel9",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.3,
"impactScore": 3.4
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-12-19T15:13:18.624274Z",
"id": "CVE-2025-14946",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-88"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2025-14946",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2423789",
"source": "[email protected]"
},
{
"url": "https://libguestfs.org/libnbd-release-notes-1.24.1.html#Security",
"source": "[email protected]"
}
]
}