CVE-2026-63623

Name of the Vulnerable Software and Affected Versions libvirt versions prior to 12.6.0-1.1

Description A flaw exists during storage volume clone or convert operations where newly created volume images are temporarily world-readable. This occurs because the qemu-img utility operates with overly permissive file creation settings, which allows any local user to read the full contents of the guest disk, potentially leading to the disclosure of sensitive information from guest virtual machines.

Recommendations Update to version 12.6.0-1.1.