The libvirt package in Red Hat Enterprise Linux 9 contains a denial of service vulnerability in its XML parsing functionality (CVE-2025-12748). Libvirt provides user-space APIs and components to manage virtual machines running on KVM. This vulnerability could allow an attacker to cause a denial of service condition by exploiting the XML parsing flaw. Red Hat has issued a security advisory (RHSA-2026:18748) with an update to libvirt that fixes this issue. The advisory covers multiple RHEL 9 variants and architectures. No CVSS score is provided in the advisory, but the severity is classified as moderate.

Successful exploitation of this vulnerability could result in a denial of service condition affecting the libvirt service managing virtual machines. This may disrupt virtualization management operations on affected Red Hat Enterprise Linux 9 systems. There is no indication of privilege escalation or remote code execution from the provided data. No known exploits in the wild have been reported.

Red Hat has released an official security update for libvirt in Red Hat Enterprise Linux 9 to address this denial of service vulnerability. Users should apply the update as described in the Red Hat advisory RHSA-2026:18748 and the linked Red Hat article https://access.redhat.com/articles/11258. The update is available for multiple RHEL 9 variants and architectures. Applying this update mitigates the vulnerability. No additional mitigation actions are specified or required.