The vulnerability exists in KubeVirt's virt-handler component used in Red Hat OpenShift Virtualization 4. The WriteToCachedFile function writes data to a file path rooted at the launcher without checking for symbolic links. This lack of symlink protection enables a user with access to the virt-launcher container to create a symlink at the cache file path. When virt-handler follows this symlink, it can overwrite arbitrary files on the host system with JSON content and modify file ownership, potentially impacting system integrity.

An attacker with low privileges inside the virt-launcher container can exploit this flaw to overwrite arbitrary files on the host system and change their ownership. This can lead to integrity issues and potential denial of service. Confidentiality is not impacted, but availability and integrity are affected to a limited extent. The CVSS score is 4.2 (medium severity) reflecting the local attack vector, required privileges, and limited impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-13218 for current remediation guidance. Until an official fix is available, restrict access to the virt-launcher container to trusted users only to prevent exploitation. Monitor Red Hat's advisory for updates on patches or workarounds.