libnbd CVE-2025-14946

Exploitation requires an application or user to pass an attacker-controlled NBD URI to libnbd for opening - specifically a URI whose hostname begins with '-o' so that ssh interprets it as a command-line option instead of a host, which only matters for the SSH transport (nbd+ssh:// style connections). Limiting factors: the base vector is local (AV:L) with required user interaction (UI:R), meaning a victim with a libnbd-using process must be convinced to open the crafted URI; code execution runs only with the privileges of the (possibly unprivileged) user running libnbd, and the fix ships in libnbd 1.24.1. Practical reach increases only where an application automatically opens untrusted URIs received over the network.

This is a genuine argument-injection flaw (CWE-88) in libnbd that the vendor rates only 4.8 (Medium), and the aggregate signals support treating it as low-to-medium operational priority rather than an emergency. The provided CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L already encodes strong limiting factors: local attack vector, required user interaction, and low privileges, with impacts scored only Low across CIA. EPSS is very low at 0.14% (3rd percentile), there is no CISA KEV listing, and no public proof-of-concept is referenced - so exploitation status is 'no public exploit identified at time of analysis.' The one point of internal tension is impact: the description states the flaw 'could lead to arbitrary code execution with the privileges of the user running libnbd,' which is normally full compromise of that user's context (C:H/I:H/A:H), yet Red Hat scored it C:L/I:L/A:L - a conservative rating that arguably understates technical impact; verify impact scoping with the vendor. A second ambiguity is the attack vector: the flaw triggers when libnbd is 'convinced' to open a crafted URI, and if an application feeds attacker-controlled NBD URIs received over the network, the practical reachability edges toward AV:N even though the base vector says AV:L. Net: real, patchable code-quality bug in a niche virtualization library, low probability of widespread exploitation, worth patching on a normal cycle.

An attacker supplies a malicious NBD URI whose hostname begins with '-o' (for example via an nbd+ssh:// connection string) to an application or user that passes untrusted URIs to libnbd. When libnbd builds the SSH command line, the '-o...' hostname is parsed by ssh as an option rather than a host, letting the attacker inject ssh options (e.g., ProxyCommand) that execute arbitrary commands with the privileges of the user running libnbd. No public exploit code is referenced, and the CVSS vector requires local invocation plus user interaction (UI:R), so delivery depends on convincing a victim to open the crafted URI.