CVE-2025-64437

KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock is a symlink or a regular file. This oversight can be exploited, for example, to change the ownership of arbitrary files on the host node to the unprivileged user with UID 107 (the same user used by virt-launcher) thus, compromising the CIA (Confidentiality, Integrity and Availability) of data on the host. To successfully exploit this vulnerability, an attacker should be in control of the file system of the virt-launcher pod. This vulnerability is fixed in 1.5.3 and 1.6.1.

• CWE-59

• https://github.com/kubevirt/kubevirt/commit/3ce9f41c54d04a65f10b23a46771391c00659afbPatch
• https://github.com/kubevirt/kubevirt/commit/8644dbe0d04784b0bfa8395b91ecbd6001f88f6bPatch
• https://github.com/kubevirt/kubevirt/commit/f59ca63133f25de8fceb3e2a0e5cc0b7bdb6a265Patch
• https://github.com/kubevirt/kubevirt/security/advisories/GHSA-2r4r-5x78-mvqfExploit, Vendor Advisory

Published

Nov 7, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64431Zitadel is an open source identity management platform. Vers…8.7
• CVE-2025-64432KubeVirt is a virtual machine management add-on for Kubernet…4.7
• CVE-2025-64433KubeVirt is a virtual machine management add-on for Kubernet…6.5
• CVE-2025-64434KubeVirt is a virtual machine management add-on for Kubernet…6.3
• CVE-2025-64435KubeVirt is a virtual machine management add-on for Kubernet…5.3
• CVE-2025-64436KubeVirt is a virtual machine management add-on for Kubernet…5.3
• CVE-2025-64438Fast DDS is a C++ implementation of the DDS (Data Distributi…7.5
• CVE-2025-64439LangGraph SQLite Checkpoint is an implementation of LangGrap…7.4
• CVE-2025-6444ServiceStack GetErrorResponse Improper Input Validation NTLM…5.9
• CVE-2025-64442HumHub is an Open Source Enterprise Social Network. Versions…6.1
• CVE-2025-64443MCP Gateway allows easy and secure running and deployment of…9.6
• CVE-2025-64444Improper neutralization of special elements used in an OS co…8.6