Is CVE-2025-12748 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-12748 being exploited in the wild.

How severe is CVE-2025-12748?

Medium severity, with a CVSS score of 5.5, published 11 November 2025.

Which products and versions are affected?

Libvirt Fixed in 11.10.0-12.el9_8 and later versions; Red Hat Enterprise Linux 10 All versions prior to RHSA-2026:18326; Red Hat Enterprise Linux 9 All versions prior to RHSA-2026:18748.

Is there a fix for CVE-2025-12748?

A patch was published on 2026-05-19: Red Hat released security updates for RHEL 9 and 10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-12748 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-12748?

Check whether you run Libvirt, Red Hat Enterprise Linux 10 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-12748: libvirt denial of service via XML parsing resource exhaustion

CVE-2025-12748 · Severity: medium · CVSS 5.5 · Published 2025-11-11

A vulnerability was found in libvirt, a tool used to manage virtualization platforms like KVM. An attacker with limited access to the system can provide a specially crafted configuration file that forces the software to consume all available memory. This can cause the virtualization service to crash, potentially disrupting all virtual machines running on the host.

Technologies: Libvirt, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9. Vendors: Libvirt, Red Hat.

Quick answers

Is CVE-2025-12748 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-12748 being exploited in the wild.
How severe is CVE-2025-12748?: Medium severity, with a CVSS score of 5.5, published 11 November 2025.
Which products and versions are affected?: Libvirt Fixed in 11.10.0-12.el9_8 and later versions; Red Hat Enterprise Linux 10 All versions prior to RHSA-2026:18326; Red Hat Enterprise Linux 9 All versions prior to RHSA-2026:18748.
Is there a fix for CVE-2025-12748?: A patch was published on 2026-05-19: Red Hat released security updates for RHEL 9 and 10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-12748 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-12748?: Check whether you run Libvirt, Red Hat Enterprise Linux 10 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability (CWE-770) exists in libvirt's XML processing logic. The root cause is that libvirt parses user-provided XML files before performing Access Control List (ACL) checks. A local attacker with low privileges can submit a maliciously crafted XML file that triggers excessive memory allocation during the parsing phase. This leads to a denial-of-service (DoS) condition by crashing the libvirt daemon on the host. The issue has been addressed in Red Hat Enterprise Linux via security updates RHSA-2026:18748 and RHSA-2026:18326.

Affected products

libvirt libvirt Fixed in 11.10.0-12.el9_8 and later versions
Red Hat Enterprise Linux 9 All versions prior to RHSA-2026:18748
Red Hat Enterprise Linux 10 All versions prior to RHSA-2026:18326

Timeline

2025-11-10: disclosed: Bug reported to Red Hat Bugzilla
2025-11-11: advisory: CVE published by NVD/Red Hat
2026-05-19: patched: Red Hat released security updates for RHEL 9 and 10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.