CVE-2025-64435: medium-severity vulnerability in kubevirt
KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.4%
KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can mislead the virt-controller into associating the fake pod with the VMI, resulting in incorrect status updates and potentially causing a DoS (Denial-of-Service). This vulnerability is fixed in 1.7.0-beta.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
kubevirt · kubevirtRelated CVEs — kubevirt
In the same product, most dangerous first.
CVE-2023-26484HIGHOn a compromised KubeVirt node, the virt-handler service account can be used to modify all node specsEPSS 0.6%CVE-2025-64433MEDIUMKubeVirt Arbitrary Container File ReadEPSS 0.5%CVE-2025-64436MEDIUMKubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between NodesEPSS 0.3%CVE-2025-64324HIGHKubeVirt Vulnerable to Arbitrary Host File Read and WriteEPSS 0.2%CVE-2025-64437MEDIUMKubeVirt Isolation Detection Flaw Allows Arbitrary File Permission ChangesEPSS 0.2%CVE-2025-64434MEDIUMKubeVirt Improper TLS Certificate Management Handling Allows API Identity SpoofingEPSS 0.2%