CVE-2013-1922: qemu-nbd in QEMU, as used in Xen 4.2.x, determines the format of a raw disk image based on the header, whic...

Security readout for executives and security teams

A guest administrator on an affected Xen/QEMU setup could manipulate a virtual disk header so qemu-nbd treats a raw image as another format after restart. That could let the guest read files from the host, creating a virtualization boundary breach. The provided sources do not give a CVSS score or evidence of active exploitation. Exposure appears limited to environments using affected QEMU qemu-nbd behavior, specifically noted with Xen 4.2.x, where guest disk format is not explicitly specified. Risk is highest for multi-tenant virtualization or hosting where guest administrators are not trusted by the host operator. Prioritize if the organization runs old Xen/QEMU virtualization for customers, labs, or tenant-isolated workloads. The business issue is possible host file exposure from a guest admin. Legacy or unsupported platforms should be updated or isolated promptly. Mitigation focus: Check current vendor guidance for QEMU, Xen, and distribution-specific packages.; Apply relevant QEMU or Xen updates from supported vendor channels.; Explicitly specify guest disk image format where platform tooling supports it..

Prepared

Jun 14, 2026, 22:07 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.