CVSS 3.1
8.2 highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:HCVE-2026-24708
High (8.2). EPSS 0.4% chance of exploitation in the next 30 days.
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-669, CWE-73
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m4f3-qp2w-gwh6 | PyPI | nova | >=32.0.0.0rc1 <=32.1.0 | no fix published |
| GHSA-m4f3-qp2w-gwh6 | PyPI | nova | >=31.0.0.0rc1 <=31.2.0 | no fix published |
| GHSA-m4f3-qp2w-gwh6 | PyPI | nova | <=30.2.1 | no fix published |
| PYSEC-2026-2685 | PyPI | nova | <=30.2.1 >=31.0.0.0rc1 <=31.2.0 >=32.0.0.0rc1 <=32.1.0 | no fix published |