Quick answers
- Is CVE-2025-13193 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-13193 being exploited in the wild.
- How severe is CVE-2025-13193?
- Medium severity, with a CVSS score of 5.5, published 17 November 2025.
- Which products and versions are affected?
- libvirt libvirt < 11.10.0; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Enterprise Linux 10; and 1 more.
- Is there a fix for CVE-2025-13193?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-13193 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2025-13193?
- Check whether you run Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability classified as Incorrect Default Permissions (CWE-276) exists in libvirt. When creating external inactive snapshots for virtual machines in a shut-down state, the software fails to restrict file permissions, resulting in world-readable snapshot files. A local, unprivileged attacker can exploit this to read the disk image contents of the guest OS, bypassing intended isolation boundaries. The issue is addressed in libvirt version 11.10.0 and via upstream patches.
Affected products
- libvirt libvirt < 11.10.0
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat In-Vehicle Operating System 1
Timeline
- 2025-11-17: disclosed: Initial report and CVE assignment
- 2025-11-17: advisory: NVD and Red Hat advisories published