CVE-2025-14946CWE-88

CVE-2025-14946

Medium · published December 19, 2025

CVSS v3.1
4.8
EPSS
0%
Percentile
3.4
In the wild
Unconfirmed
What it is

A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.

The record
Technical detail
CVSS v3.1
4.8 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00144 · 3.4th percentile
Weakness
CWE-88 · Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Published
2025-12-19T18:16Z
References (3)
https://access.redhat.com/security/cve/CVE-2025-14946 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2423789 · [email protected]https://libguestfs.org/libnbd-release-notes-1.24.1.html#Security · [email protected]
EPSS history
Timeline
  • 19 DEC 13:02Z
    Libnbd: libnbd: arbitrary code execution via ssh argument injection through a malicious uri
    cvelistv5