Qemu · Qemu-Img · CVE-2026-24708
**Name of the Vulnerable Software and Affected Versions**
OpenStack Nova versions prior to 30.2.2
OpenStack Nova versions prior to 31.2.1
OpenStack Nova versions prior to 32.1.1
**Description**
A flaw in the interaction between OpenStack Nova and the `qemu-img` utility allows an authenticated user to overwrite arbitrary files or destroy data on the compute host. The issue occurs when Nova's Flat image backend invokes `qemu-img` without strictly constraining the disk image format. An attacker can exploit this by writing a malicious QCOW header to a root or ephemeral disk and triggering a resize operation. This vulnerability specifically affects compute nodes using the Flat image backend, typically those configured with `use cow images` set to `False`.
**Recommendations**
Update OpenStack Nova to version 30.2.2 or later.
Update OpenStack Nova to version 31.2.1 or later.
Update OpenStack Nova to version 32.1.1 or later.
As a temporary mitigation, avoid using the Flat image backend by ensuring `use cow images` is not set to `False`.