{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-24708", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-02-18T17:03:53.469Z", "dateReserved": "2026-01-24T00:00:00.000Z", "datePublished": "2026-02-18T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Nova", "vendor": "OpenStack", "versions": [{"lessThan": "30.2.2", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThan": "31.2.1", "status": "affected", "version": "31.0.0", "versionType": "semver"}, {"lessThan": "32.1.1", "status": "affected", "version": "32.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-669", "description": "CWE-669 Incorrect Resource Transfer Between Spheres", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-02-18T17:03:53.469Z"}, "references": [{"url": "https://bugs.launchpad.net/nova/+bug/2137507"}, {"url": "https://www.openwall.com/lists/oss-security/2026/02/17/7"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H"}}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*", "versionEndExcluding": "30.2.2"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*", "versionStartIncluding": "31.0.0", "versionEndExcluding": "31.2.1"}, {"vulnerable": true, "criteria": "cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*", "versionStartIncluding": "32.0.0", "versionEndExcluding": "32.1.1"}]}]}]}}, "dataVersion": "5.2"}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected."}], "id": "CVE-2026-24708", "lastModified": "2026-02-18T18:24:33.087", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.8, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2026-02-18T18:24:33.087", "references": [{"source": "cve@mitre.org", "url": "https://bugs.launchpad.net/nova/+bug/2137507"}, {"source": "cve@mitre.org", "url": "https://www.openwall.com/lists/oss-security/2026/02/17/7"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-669"}], "source": "cve@mitre.org", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank Dan Smith (RedHat) for reporting this issue.", "bugzilla": {"description": "openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova", "id": "2430312", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2430312"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-73", "details": ["A flaw in OpenStack Nova\u2019s interaction with the qemu-img utility allows an authenticated user to overwrite arbitrary files on the compute host. This occurs because Nova invokes qemu-img without strictly constraining the disk image format, enabling a malicious user to craft a QCOW2 header on a raw disk and trigger destructive behavior during instance operations such as resize."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-24708", "package_state": [{"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Affected", "package_name": "rhosp13/openstack-nova-compute", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rhosp12/openstack-nova-compute", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "rhosp-rhel8/openstack-nova-compute", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Not affected", "package_name": "rhosp-rhel9/openstack-nova-compute", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Not affected", "package_name": "rhosp12/openstack-nova-compute", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "rhosp-rhel9/openstack-nova-compute", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Not affected", "package_name": "rhoso/openstack-nova-compute-rhel9", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Not affected", "package_name": "rhosp12/openstack-nova-compute", "product_name": "Red Hat OpenStack Platform 18.0"}, {"cpe": "cpe:/a:redhat:openstack:18.0", "fix_state": "Affected", "package_name": "rhosp-rhel9/openstack-nova-compute", "product_name": "Red Hat OpenStack Platform 18.0"}], "public_date": "2026-02-17T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-24708\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-24708"], "statement": "This vulnerability is rated Important for Red Hat OpenStack Platform. An authenticated attacker can exploit unconstrained disk format handling in OpenStack Nova when invoking qemu-img. By crafting a QCOW2 header on an ephemeral or root disk, an attacker can cause qemu-img to overwrite arbitrary files on the compute host with Nova's write access, leading to data destruction or denial of service.", "threat_severity": "Important"}