Is CVE-2026-77159 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-77159?

CVE-2026-77159 has a CVSS v3 severity of MEDIUM (5.5).

Back

CVE-2026-77159

Description

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user.