BaseFortify

Publication date: 2025-11-07

Last updated on: 2025-11-25

Assigner: GitHub, Inc.

Description

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can mislead the virt-controller into associating the fake pod with the VMI, resulting in incorrect status updates and potentially causing a DoS (Denial-of-Service). This vulnerability is fixed in 1.7.0-beta.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-07

Last Modified

2025-11-25

Generated

2026-07-06

AI Q&A

2025-11-08

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64435

Affected Vendors & Products

Vendor	Product	Version / Range
kubevirt	kubevirt	to 1.6.3 (inc)
kubevirt	kubevirt	1.7.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-703	The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Attack-Flow Graph

Executive Summary

This vulnerability in KubeVirt's virt-controller is a logic flaw that allows an attacker to disrupt control over a running Virtual Machine Instance (VMI). The attacker can create a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This causes the virt-controller to mistakenly associate the fake pod with the VMI, leading to incorrect status updates and potentially causing a Denial-of-Service (DoS) condition.

Impact Analysis

The vulnerability can impact you by causing a Denial-of-Service (DoS) on your virtual machine instances managed by KubeVirt. This means that the control over running VMIs can be disrupted, potentially leading to downtime or unavailability of critical virtual machines.

Mitigation Strategies

Upgrade KubeVirt to version 1.7.0-beta.0 or later, as this version contains the fix for the vulnerability.

Hi! I’m here to help you understand CVE-2025-64435. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70