CVE-2013-4401: Red Hat Libvirt

High severity, CVSS 8.5. EPSS: 1.7% chance of exploitation in the next 30 days.

The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.

Affected products

• Red Hat Libvirt: version 1.1.0 only; version 1.1.1 only; version 1.1.2 only; version 1.1.3 only

Published 2013-11-02. Last modified 2026-06-16.