CVE-2018-10908: Ovirt Vdsm

Medium severity, CVSS 6.3. EPSS: 1.2% chance of exploitation in the next 30 days.

It was found that vdsm before version 4.20.37 invokes qemu-img on untrusted inputs without limiting resources. By uploading a specially crafted image, an attacker could cause the qemu-img process to consume unbounded amounts of memory of CPU time, causing a denial of service condition that could potentially impact other users of the host.

Affected products

• Ovirt Vdsm: before 4.20.37 (fixed in 4.20.37)
• Red Hat Virtualization: version 4.0 only

Published 2018-08-09. Last modified 2026-06-17.