{"id":"CVE-2026-77159","title":"A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function","summary":"A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-61"],"vendor":"Red Hat","product":"libvirt","affected":["libvirt (all versions)","libvirt","libvirt","virt:rhel/libvirt (all versions)","libvirt (all versions)"],"published":"2026-09-11","updated":"2026-09-16","sourceUpdated":"2026-09-16T19:42:43.623","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77159","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-77159","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531811","label":"secalert@redhat.com"},{"url":"https://gitlab.com/libvirt/libvirt/-/work_items/909","label":"secalert@redhat.com"},{"url":"https://gitlab.com/libvirt/libvirt/-/work_items/909","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00162,"epssPercentile":0.05861,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-15T15:39:11.306501Z"},"ingestedAt":"2026-09-12T18:47:14.696Z","slug":"CVE-2026-77159","body":"## Overview\n\nA symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":204255,"id":"CVE-2026-77159","ts":1789490437232,"field":"exploit_available","old":"false","new":"true"}]}