CVE-2025-64437
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-07

Last updated on: 2025-11-25

Assigner: GitHub, Inc.

Description
KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node to the unprivileged user with UID 107 (the same user used by virt-launcher) thus, compromising the CIA (Confidentiality, Integrity and Availability) of data on the host. To successfully exploit this vulnerability, an attacker should be in control of the file system of the virt-launcher pod. This vulnerability is fixed in 1.5.3 and 1.6.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-07
Last Modified
2025-11-25
Generated
2026-06-16
AI Q&A
2025-11-08
EPSS Evaluated
2026-06-15
NVD
CVE-2025-64437
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
kubevirt kubevirt to 1.5.3 (exc)
kubevirt kubevirt 1.6.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in KubeVirt occurs because the virt-handler component does not check if the launcher-sock is a symlink or a regular file. An attacker who controls the file system of the virt-launcher pod can exploit this to change ownership of arbitrary files on the host node to an unprivileged user (UID 107), potentially compromising the confidentiality, integrity, and availability of data on the host.

Impact Analysis

If exploited, this vulnerability can allow an attacker to change ownership of arbitrary files on the host node to an unprivileged user, which can lead to unauthorized access, modification, or disruption of critical data and services, thereby compromising the confidentiality, integrity, and availability of the host system's data.

Mitigation Strategies

Upgrade KubeVirt to version 1.5.3 or 1.6.1 or later, as these versions contain the fix for this vulnerability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64437. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart