CVE-2026-24708 is a vulnerability in OpenStack Nova where the interaction with the qemu-img utility lacks strict constraints on disk image formats. An authenticated attacker can craft a QCOW2 header on an ephemeral or root disk image that causes qemu-img to overwrite arbitrary files on the compute host with Nova's write permissions. This flaw arises from unconstrained format handling, leading to potential data destruction or denial of service during instance operations such as resizing. The vulnerability is tracked under CWE-73 (External Control of File Name or Path) and CWE-669 (Improper Control of a Resource Through its Lifetime). Red Hat has issued security advisories and updates for affected versions of Red Hat OpenStack Services on OpenShift 18.0.18 to mitigate this issue.

An authenticated attacker with access to OpenStack Nova can exploit this vulnerability to overwrite arbitrary files on the compute host. This can result in data destruction or denial of service conditions, impacting the integrity and availability of the host system. Confidentiality is not directly impacted. The vulnerability requires local or authenticated access and has low attack complexity and privileges required. There are no known exploits in the wild at this time.

Red Hat has released security updates for Red Hat OpenStack Services on OpenShift 18.0.18 (openstack-nova-27.5.2-18.0.20260312122217) that address this vulnerability. Applying these official updates is the recommended remediation. Currently, no alternative mitigations meet Red Hat's criteria for ease of use, deployment, or stability. Users should follow Red Hat's guidance and update to the fixed package versions as detailed in the advisory at https://access.redhat.com/errata/RHSA-2026:7884.