PT-2026-61584 · Libvirt+1 · Libvirt+1

CVE-2026-12080 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QEMU Guest Agent (affected versions not specified)

Description A flaw exists in the QEMU Guest Agent (qga) within the guest-ssh-add-authorized-keys command handler. A local unprivileged user can exploit this by manipulating symbolic links through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. TOCTOU is a race condition where a system checks a condition (such as a file's existence) and then uses the result, but the condition changes between the check and the use. Successful exploitation allows an attacker to gain ownership of arbitrary root-owned files or directories, resulting in root access. This issue requires an external management layer, such as libvirt, to trigger the affected code path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the QEMU Guest Agent immediately.

LPE

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2026-12080

Affected Products

Qemu Guest Agent

Libvirt

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-12080 · Security Note
• https://twitter.com/HugoValters/status/2079285462762651822 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2499603 · Note
• https://gitlab.com/qemu-project/qemu/-/work_items/3929 · Note
• https://access.redhat.com/security/cve/CVE-2026-12080 · Note