An attacker running a malicious virtual machine can manipulate the QCOW2 disk header to point to a file on the host system. When the host VM image is later read by the hypervisor during boot or a disk scan, the host file’s contents are delivered to the guest, effectively allowing the guest to retrieve any file the hypervisor process can access. The vulnerability is an example of CWE‑73, where a file path is derived from untrusted user input allowing directory traversal or arbitrary file access. The impact is therefore data exfiltration from the host to the guest, potentially exposing sensitive files such as configuration or credential stores, limited by the host process file permissions.

The issue affects Cloud Hypervisor versions 34.0 through 50.0 when virtio‑block devices use raw image files. Only images that are writable by the guest or derived from an untrusted source enable the attack. Trusted, read‑only images are not vulnerable. The vulnerability was identified by the Cloud Hypervisor project and addressed in version 50.1.

The flaw carries a CVSS score of 9.1, indicating severe risk, but the EPSS score is less than 1 %, suggesting low probability of widespread exploitation at present. It is not listed in the CISA KEV catalog. The attack can be performed with a single boot or reboot of the guest VM, without interacting with the management stack, and the Cloud Hypervisor process does not terminate upon triggering. Thus, the attack vector is a guest‑initiated operation exploiting file path dependencies in the hypervisor’s image processing logic.