DEBIAN-CVE-2025-12748

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2025-12748
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-12748.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2025-12748
Upstream
Published
2025-11-11T20:15:34Z
Modified
2026-09-01T16:06:08Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.

References

Affected packages

Debian:12 / libvirt

Package

Name
libvirt
Purl
pkg:deb/debian/libvirt?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.0.0-4
9.0.0-4+deb12u1
9.0.0-4+deb12u2
9.1.0-1
9.2.0-1
9.2.0-2
9.3.0-1
9.3.0-2
9.4.0-1
9.5.0-1
9.5.0-2
9.6.0-1
9.6.0-2
9.6.0-3
9.7.0-1
9.8.0-1
9.8.0-2
9.9.0-1
9.10.0-1
10.*
10.0.0-1
10.0.0-2
10.0.0-3
10.1.0-1
10.2.0-1
10.3.0-1
10.3.0-2
10.3.0-3
10.4.0-1
10.5.0-1
10.6.0-1
10.6.0-2
10.6.0-3
10.7.0-1
10.7.0-2
10.7.0-3
10.8.0-1
10.9.0-1
10.9.0-2
10.10.0-1
10.10.0-2
10.10.0-3
10.10.0-4
11.*
11.0.0-1
11.0.0-2
11.1.0-1
11.1.0-2
11.2.0-1
11.2.0-2
11.2.0-3
11.3.0-1
11.3.0-2~bpo12+1
11.3.0-2
11.3.0-3
11.4.0-1
11.5.0-1
11.6.0-1
11.7.0-1
11.8.0-1
11.8.0-2
11.9.0-1
11.9.0-2
11.10.0-1
11.10.0-2
12.*
12.0.0-1
12.1.0-1
12.2.0-1
12.3.0-1
12.4.0-1
12.5.0-1
12.6.0-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-12748.json"

Debian:13 / libvirt

Package

Name
libvirt
Purl
pkg:deb/debian/libvirt?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
11.3.0-3+deb13u2

Affected versions

11.*
11.3.0-3
11.3.0-3+deb13u1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-12748.json"

Debian:14 / libvirt

Package

Name
libvirt
Purl
pkg:deb/debian/libvirt?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
11.10.0-1

Affected versions

11.*
11.3.0-3
11.4.0-1
11.5.0-1
11.6.0-1
11.7.0-1
11.8.0-1
11.8.0-2
11.9.0-1
11.9.0-2

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-12748.json"