Riskcovery

CVE-2025-14946

Libnbd: libnbd: arbitrary code execution via ssh argument injection through a malicious uri

State
Published
Severity
4.8 Medium
Published
Dec 19, 2025
Updated
Dec 22, 2025
Reserved
Dec 19, 2025

Read the record on cve.org

Description

A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.

Scores

CVSSScoreVectorSource
3.14.8 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:Lredhat

Weaknesses

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected Products

ProductVersions
libnbdRed Hat
  • 1.22.0 to before 1.22.5Affected
  • 1.23.0 to before 1.23.9Affected
Red Hat Enterprise Linux 10Red Hat
    Red Hat Enterprise Linux 8Red Hat
      Red Hat Enterprise Linux 9Red Hat
        Red Hat OpenShift Virtualization 4Red Hat
          Red Hat OpenShift Virtualization 4Red Hat
            Red Hat OpenShift Virtualization 4Red Hat
              Red Hat OpenShift Virtualization 4Red Hat
                Red Hat OpenShift Virtualization 4Red Hat
                  Red Hat OpenShift Virtualization 4Red Hat
                    Red Hat OpenShift Virtualization 4Red Hat
                      Red Hat OpenShift Virtualization 4Red Hat
                        Red Hat OpenShift Virtualization 4Red Hat
                          Red Hat OpenShift Virtualization 4Red Hat
                            Red Hat OpenShift Virtualization 4Red Hat
                              Red Hat OpenShift Virtualization 4Red Hat
                                Red Hat OpenShift Virtualization 4Red Hat
                                  Red Hat OpenShift Virtualization 4Red Hat

                                    References

                                    Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.