VDB
CVE-2025-14946
CVE-2025-14946
PUBLISHED
CVSS 4.800000190734863 MEDIUM
A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.
EPSS 0.14% · 3.1th percentile
Risk Scores
CVSS 3.1
4.800000190734863
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
EPSS Score
0.14%
3.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat OpenShift Virtualization 4 | |
| Red Hat | Red Hat OpenShift Virtualization 4 | |
| Red Hat | Red Hat OpenShift Virtualization 4 | |
| Red Hat | Red Hat OpenShift Virtualization 4 | |
| Red Hat | Red Hat OpenShift Virtualization 4 | |
| Red Hat | Red Hat OpenShift Virtualization 4 | |
| Red Hat | Red Hat OpenShift Virtualization 4 | |
| Red Hat | Red Hat OpenShift Virtualization 4 | |
| Red Hat | Red Hat OpenShift Virtualization 4 | |
| Red Hat | Red Hat Enterprise Linux 8 | |
| Red Hat | Red Hat Enterprise Linux 10 | |
| Red Hat | Red Hat OpenShift Virtualization 4 | |
| Red Hat | Red Hat OpenShift Virtualization 4 | |
| Red Hat | Red Hat OpenShift Virtualization 4 | |
| Red Hat | Red Hat Enterprise Linux 9 | |
| Red Hat | libnbd | 1.23.0, 1.22.0 |
| Red Hat | Red Hat OpenShift Virtualization 4 | |
| Red Hat | Red Hat OpenShift Virtualization 4 |
Timeline
- Dec 19, 2025 CVE ID Reserved
- Dec 19, 2025 CVE Published
- Dec 20, 2025 EPSS Score
- Dec 22, 2025 CVE Updated
- Dec 24, 2025 EPSS Score
- Dec 28, 2025 EPSS Score
- Jan 1, 2026 EPSS Score
- Jan 5, 2026 EPSS Score
- Jan 9, 2026 EPSS Score
- Jan 13, 2026 EPSS Score
- Jan 17, 2026 EPSS Score
- Jan 21, 2026 EPSS Score