Vulnerability Description
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://bugs.launchpad.net/nova/+bug/2137507
- https://www.openwall.com/lists/oss-security/2026/02/17/7
- https://lists.debian.org/debian-lts-announce/2026/02/msg00025.html
FAQ
What is CVE-2026-24708?
CVE-2026-24708 is a vulnerability with a CVSS score of 8.2 (HIGH). An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may...
How severe is CVE-2026-24708?
CVE-2026-24708 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-24708?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.