{"schemaVersion":3,"id":"CVE-2025-64435","aliases":["CGA-c4jm-324w-qj57","CGA-mhcp-hphj-qh8r","CGA-mjg8-qh5h-654c","CGA-mxg9-wfrr-vg4m","GHSA-9m94-w2vq-hcf9","GO-2025-4105","CGA-293m-r4gr-vf6r","CGA-2fg7-7h62-h4x4","CGA-2mmx-96vj-5878","CGA-2p73-hwgf-5jr7","CGA-3hcx-q5c7-f2qw","CGA-49j2-fj3v-c8qj","CGA-4mc9-p8fw-g9wv","CGA-52wp-2885-7j9w","CGA-56pq-gpw3-h2vg","CGA-5fr6-c4xp-mpwc","CGA-5r8h-32g5-qg7f","CGA-79pm-wmf8-xgjm","CGA-8q9j-7h69-45cj","CGA-c7jm-vjq3-f2jg","CGA-fj57-688f-v792","CGA-gqw7-h59v-6fxv","CGA-gr53-8hhv-7w5f","CGA-hfc8-mx97-w57h","CGA-hj4f-g6xc-9cj6","CGA-j8w6-hw6x-389p","CGA-m6fp-c26r-m574","CGA-p963-9q49-p6jh","CGA-pv63-fjpq-v795","CGA-q384-8vwh-458m","CGA-q7w6-gq24-6pj5","CGA-q9cf-6w6j-q57m","CGA-rrw7-p3fm-c9gh","CGA-vv8x-56q2-rwjm","CGA-w3mh-99m5-g5jr","CGA-wf4g-m2p3-43hm","CGA-wgj8-v5qg-wcwx"],"status":"published","duplicateOf":null,"title":null,"description":"KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.7.0-beta.0, a logic flaw in the virt-controller allows an attacker to disrupt the control over a running VMI by creating a pod with the same labels as the legitimate virt-launcher pod associated with the VMI. This can mislead the virt-controller into associating the fake pod with the VMI, resulting in incorrect status updates and potentially causing a DoS (Denial-of-Service). This vulnerability is fixed in 1.7.0-beta.0.","dates":{"published":"2025-11-07T22:57:02.600Z","modified":"2025-11-10T19:01:13.977Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.3,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","exploitability":4.1,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Go","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","exploitability":4.1,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","exploitability":4.1,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.3,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00412,"percentile":0.34058,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.028000000000000032,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00384},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00412,"percentile":0.34058}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00384,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00412,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00412,"percentile":0.34058}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_KUBEVIRT_KUBEVIRT","name":"Kubevirt","source":"github","url":"https://github.com/kubevirt/kubevirt/security/advisories/GHSA-qv98-3369-g364","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-703","name":"Improper Check or Handling of Exceptional Conditions","description":"The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.","type":"weakness","status":"Incomplete","abstraction":"Pillar","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/703.html"}],"affected":[{"vendor":"chainguard","product":"docker-machine-driver-harvester","name":"docker-machine-driver-harvester","label":"docker-machine-driver-harvester","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/docker-machine-driver-harvester","purlType":"apk","versions":[{"text":"< 1.0.5-r0","noFixRecorded":false,"fixedIn":null},{"text":"< 1.0.7-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.0.5-r0 | < 1.0.7-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"virt-api-1.6","name":"virt-api-1.6","label":"virt-api-1.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/virt-api-1.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"virt-api-fips-1.6","name":"virt-api-fips-1.6","label":"virt-api-fips-1.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/virt-api-fips-1.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"virt-chroot-1.6","name":"virt-chroot-1.6","label":"virt-chroot-1.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/virt-chroot-1.6","purlType":"apk","versions":[{"text":"< 1.6.5-r0","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 1.6.5-r0 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"virt-chroot-fips-1.6","name":"virt-chroot-fips-1.6","label":"virt-chroot-fips-1.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/virt-chroot-fips-1.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"virt-controller-1.6","name":"virt-controller-1.6","label":"virt-controller-1.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/virt-controller-1.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"virt-controller-fips-1.6","name":"virt-controller-fips-1.6","label":"virt-controller-fips-1.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/virt-controller-fips-1.6","purlType":"apk","versions":[{"text":"< 1.6.6-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.6-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"virt-handler-1.6","name":"virt-handler-1.6","label":"virt-handler-1.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/virt-handler-1.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"virt-handler-fips-1.6","name":"virt-handler-fips-1.6","label":"virt-handler-fips-1.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/virt-handler-fips-1.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"virt-launcher-1.6","name":"virt-launcher-1.6","label":"virt-launcher-1.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/virt-launcher-1.6","purlType":"apk","versions":[{"text":"< 1.6.6-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.6-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"virt-launcher-1.6-virt-freezer","name":"virt-launcher-1.6-virt-freezer","label":"virt-launcher-1.6-virt-freezer","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/virt-launcher-1.6-virt-freezer","purlType":"apk","versions":[{"text":"< 1.6.6-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.6-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"virt-launcher-1.6-virt-launcher-monitor","name":"virt-launcher-1.6-virt-launcher-monitor","label":"virt-launcher-1.6-virt-launcher-monitor","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/virt-launcher-1.6-virt-launcher-monitor","purlType":"apk","versions":[{"text":"< 1.6.6-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.6-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"virt-launcher-1.6-virt-probe","name":"virt-launcher-1.6-virt-probe","label":"virt-launcher-1.6-virt-probe","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/virt-launcher-1.6-virt-probe","purlType":"apk","versions":[{"text":"< 1.6.6-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.6-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"virt-launcher-1.6-virt-tail","name":"virt-launcher-1.6-virt-tail","label":"virt-launcher-1.6-virt-tail","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/virt-launcher-1.6-virt-tail","purlType":"apk","versions":[{"text":"< 1.6.6-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.6-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"virt-operator-1.6","name":"virt-operator-1.6","label":"virt-operator-1.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/virt-operator-1.6","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"virt-operator-fips-1.6","name":"virt-operator-fips-1.6","label":"virt-operator-fips-1.6","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/virt-operator-fips-1.6","purlType":"apk","versions":[{"text":"< 1.6.6-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.6-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"docker-machine-driver-harvester","name":"docker-machine-driver-harvester","label":"docker-machine-driver-harvester","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/docker-machine-driver-harvester","purlType":"apk","versions":[{"text":"< 1.0.5-r0","noFixRecorded":false,"fixedIn":null},{"text":"< 1.0.7-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.0.5-r0 | < 1.0.7-r0","eol":null,"hubHref":null},{"vendor":"kubevirt.io","product":"kubevirt","name":"kubevirt.io/kubevirt","label":"kubevirt","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/kubevirt.io/kubevirt","purlType":"golang","versions":[{"text":"< 1.7.0-beta.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.0-beta.0","eol":null,"hubHref":null},{"vendor":"kubevirt","product":"kubevirt","name":"kubevirt","label":"kubevirt","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.7.0-beta.0","noFixRecorded":false,"fixedIn":null},{"text":"≤ 1.6.3","noFixRecorded":false,"fixedIn":null},{"text":"1.7.0:alpha0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.0-beta.0 | ≤ 1.6.3 | 1.7.0:alpha0","eol":null,"hubHref":"/vendor/kubevirt/kubevirt"}],"affectedCount":19,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/kubevirt/kubevirt/security/advisories/GHSA-9m94-w2vq-hcf9","label":"github.com/kubevirt/kubevirt/security/advisories/GHSA-9m94-w2vq-hcf9","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB","Exploit","Vendor Advisory"]},{"url":"https://github.com/kubevirt/kubevirt/commit/9a6f4a3a707992038ef705da4cb3bba8c89d36ba","label":"github.com/kubevirt/kubevirt/commit/9a6f4a3a707992038ef705da4cb3bba8c89d36ba","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","Patch"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64435.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64435.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64435","label":"nvd.nist.gov/vuln/detail/CVE-2025-64435","hostname":"nvd.nist.gov","tags":["Advisory","Oval"]},{"url":"https://github.com/kubevirt/kubevirt","label":"github.com/kubevirt/kubevirt","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:20281-1","OPENSUSE-SU-2026:21483-1","SUSE-SU-2026:0479-1","SUSE-SU-2026:20551-1","SUSE-SU-2026:20571-1","SUSE-SU-2026:20610-1"],"duplicates":[],"related":["CGA-RRJW-WPQM-25RC","OPENSUSE-SU-2026:20281-1","OPENSUSE-SU-2026:21483-1","SUSE-SU-2026:0479-1","SUSE-SU-2026:20551-1","SUSE-SU-2026:20571-1","SUSE-SU-2026:20610-1"]},"timeline":[{"kind":"published","date":"2025-11-07T22:57:02.600Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-11-10T19:01:13.977Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":31,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T18:19:16.890Z","stale":false,"partial":false}}