Vulnerability · Published Jan 26, 2026 · Assigned by redhat
CVE-2025-14525Kubevirt: kubevirt: vm administration denial of service via guest agent
Medium 6.4
In plain English
A medium-severity resource allocation without limits in Red Hat OpenShift Virtualization 4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Official description
A flaw was found in kubevirt. A user within a virtual machine (VM), if the guest agent is active, can exploit this by causing the agent to report an excessive number of network interfaces. This action can overwhelm the system's ability to store VM configuration updates, effectively blocking changes to the Virtual Machine Instance (VMI). This allows the VM user to restrict the VM administrator's ability to manage the VM, leading to a denial of service for administrative operations.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | kubevirt.io/kubevirt | no fix listed | GHSA-25mh-hp8x-cgrv |
| Go | kubevirt.io/kubevirt | no fix listed | GO-2026-4384 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat OpenShift Virtualization 4 | see references |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
References
- https://access.redhat.com/security/cve/CVE-2025-14525 vdb-entry, x_refsource_REDHAT
- RHBZ#2421360 issue-tracking, x_refsource_REDHAT