CVE-2026-24708
HIGH EPSS 30.5%
Published Feb 18, 20264mo ago · Modified Jun 17, 20262w ago
8.2 CVSS 3.1
Published Feb 18, 2026 4mo ago
Last Modified Jun 17, 2026 2w ago
Description
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Changed
Confidentiality None
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
30.5% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-669
References 3
- bugs.launchpad.net https://bugs.launchpad.net/nova/+bug/2137507
- lists.debian.org https://lists.debian.org/debian-lts-announce/2026/02/msg00025.html
- openwall.com https://www.openwall.com/lists/oss-security/2026/02/17/7
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.