CVE-2025-14525

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

A flaw was found in kubevirt. A user within a virtual machine (VM), if the guest agent is active, can exploit this by causing the agent to report an excessive number of network interfaces. This action can overwhelm the system's ability to store VM configuration updates, effectively blocking changes to the Virtual Machine Instance (VMI). This allows the VM user to restrict the VM administrator's ability to manage the VM, leading to a denial of service for administrative operations.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Jan 26, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-145268.8A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing a maniCVE-2025-145279.8A weakness has been identified in projectworlds Advanced Library Management System 1.0. This vulnerability affects unknown code of the file CVE-2025-145287.5A vulnerability was detected in D-Link DIR-803 up to 1.04. Impacted is an unknown function of the file /getcfg.php of the component ConfigurCVE-2025-145299.8A flaw has been found in Campcodes Retro Basketball Shoes Online Store 1.0. The affected element is an unknown function of the file /admin/aCVE-2025-14534.8The Category Posts Widget WordPress plugin before 4.9.20 does not sanitise and escape some of its settings, which could allow high privilegeCVE-2025-145307.2A vulnerability has been found in SourceCodester Real Estate Property Listing App 1.0. The impacted element is an unknown function of the fiCVE-2025-145314.3A vulnerability was found in code-projects Rental Management System 2.0. This affects an unknown function of the file Transaction.java of thCVE-2025-145329.8DobryCMS's upload file functionality allows an unauthenticated remote attacker to upload files of any type and extension without restrictionCVE-2025-145339.8The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.9.2.CVE-2025-145349.8A vulnerability was determined in UTT 进取 512W up to 3.1.7.7-171114. This impacts the function strcpy of the file /goform/formNatStaticMap ofCVE-2025-145359.8A vulnerability was identified in UTT 进取 512W up to 3.1.7.7-171114. Affected is the function strcpy of the file /goform/formConfigFastDirectCVE-2025-145369.8A security flaw has been discovered in code-projects Class and Exam Timetable Management 1.0. Affected by this vulnerability is an unknown f
CVE-2025-14525: Medium severity, CVSS 6.4 | Vulnix