PT-2025-52446 · Libnbd+1 · Libnbd+1

Osidb Bzimport · Published 2025-10-13 · Updated 2025-12-23 · CVE-2025-14946

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions libnbd (affected versions not specified)

Description A flaw exists in libnbd where a malicious actor could potentially achieve arbitrary code execution with the privileges of the user running libnbd. This is possible by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). The issue stems from an incorrect interpretation of non-standard hostnames starting with '-o', which are treated as arguments to the Secure Shell (SSH) process instead of being recognized as hostnames. A Uniform Resource Identifier (URI) is a string of characters used to identify a name or a resource.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

BDU:2026-02751

CVE-2025-14946

OPENSUSE-SU-2025:15842-1

Affected Products

Debian

Libnbd

References · 21

• https://ubuntu.com/security/CVE-2025-14946 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15842-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-14946 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-14946 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-14946 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02751 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-14946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14946 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2423789 · Note
• https://libguestfs.org/libnbd-release-notes-1.24.1.html#Security · Note
• https://access.redhat.com/security/cve/CVE-2025-14946 · Note
• https://t.me/CVEtracker/40271 · Telegram Post
• https://twitter.com/CVEnew/status/2002099154110366074 · Twitter Post