CVE-2026-24708

Publication date 17 February 2026

Last updated 27 February 2026

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

8.2 · High

Score breakdown

Description

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.

Status

Package Ubuntu Release Status
nova 25.10 questing
Fixed 3:32.0.0-0ubuntu1.1
24.04 LTS noble
Fixed 3:29.2.0-0ubuntu1.3
22.04 LTS jammy
Fixed 3:25.2.1-0ubuntu2.10
20.04 LTS focal
Needs evaluation
18.04 LTS bionic
Needs evaluation
16.04 LTS xenial
Needs evaluation

Severity score breakdown

Parameter Value
Base score 8.2 · High
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Scope Changed
Confidentiality None
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

References

Related Ubuntu Security Notices (USN)

Other references