CVE catalog

CVE-2025-14946

libnbd: CVE-2025-14946

Severity: High · CVSS 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Published: Dec 16, 2025, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.14% · Oct 25, 2026

A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulnerability arises because non-standard hostnames starting with '-o' are incorrectly interpreted as arguments to the Secure Shell (SSH) process, rather than as hostnames. This could lead to arbitrary code execution with the privileges of the user running libnbd.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libnbd	sid	`1.24.4-1`	fixed
Debian	libnbd	forky	`1.24.4-1`	fixed
Debian	libnbd	trixie	`1.22.2-1`	vulnerable
Debian	libnbd	bookworm	`1.14.2-1`	not affected
Ubuntu	libnbd	20.04	`1.0.3-1`	vulnerable
Ubuntu	libnbd	20.04	`1.2.1-2`	vulnerable
Ubuntu	libnbd	20.04	`1.2.2-1ubuntu2`	vulnerable
Ubuntu	libnbd	22.04	`1.6.3-1`	vulnerable
Ubuntu	libnbd	22.04	`1.8.5-1`	vulnerable
Ubuntu	libnbd	22.04	`1.10.2-1`	vulnerable
Ubuntu	libnbd	22.04	`1.10.5-1`	vulnerable
Ubuntu	libnbd	24.04	`1.16.4-1`	vulnerable
Ubuntu	libnbd	24.04	`1.18.1-1`	vulnerable
Ubuntu	libnbd	24.04	`1.18.2-1`	vulnerable
Ubuntu	libnbd	24.04	`1.18.2-1build1`	vulnerable
Ubuntu	libnbd	24.04	`1.18.2-2`	vulnerable
Ubuntu	libnbd	24.04	`1.18.2-2build1`	vulnerable
Ubuntu	libnbd	24.04	`1.20.0-1`	vulnerable
Ubuntu	libnbd	25.10	`1.22.0-1`	vulnerable
Ubuntu	libnbd	25.10	`1.22.2-1build1`	vulnerable
Ubuntu	libnbd	25.10	`1.22.2-1build2`	vulnerable
Ubuntu	libnbd	26.04	`1.22.2-1build2`	vulnerable
Ubuntu	libnbd	26.04	`1.24.0-2ubuntu1`	vulnerable
Ubuntu	libnbd	26.04	`1.24.1-1ubuntu6`	vulnerable
Ubuntu	libnbd	26.04	`1.24.2-1ubuntu1`	vulnerable
Opensuse	libnbd	tumbleweed	`1.24.0-2.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libnbd	source	sid	`1.22.5-1`	not yet assigned	Not reported	Not reported
Debian	libnbd	source	forky	`1.22.5-1`	not yet assigned	Not reported	Not reported
Debian	libnbd	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	libnbd	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Opensuse	libnbd	rpm	tumbleweed	`1.24.0-2.1`	Not reported	OPENSUSE-SU-2025:15842-1	Not reported

Notes

[trixie] libnbd: Minor issue

OpenFactory catalog packages

[Debian 13 (Trixie)]

[libnbd0]Affected
Source package: [libnbd]
Details (2)
- 1.22.2-1+b1 · amd64 · trixie
  Affected
  dsa · libnbd · debian · 13
- 1.22.2-1+b1 · arm64 · trixie
  Affected
  dsa · libnbd · debian · 13
[libnbd-bin]Affected
Source package: [libnbd]
Details (2)
- 1.22.2-1+b1 · amd64 · trixie
  Affected
  dsa · libnbd · debian · 13
- 1.22.2-1+b1 · arm64 · trixie
  Affected
  dsa · libnbd · debian · 13
[libnbd-dev]Affected
Source package: [libnbd]
Details (2)
- 1.22.2-1+b1 · amd64 · trixie
  Affected
  dsa · libnbd · debian · 13
- 1.22.2-1+b1 · arm64 · trixie
  Affected
  dsa · libnbd · debian · 13
[libnbd-ocaml]Affected
Source package: [libnbd]
Details (2)
- 1.22.2-1+b1 · amd64 · trixie
  Affected
  dsa · libnbd · debian · 13
- 1.22.2-1+b1 · arm64 · trixie
  Affected
  dsa · libnbd · debian · 13
[libnbd-ocaml-dev]Affected
Source package: [libnbd]
Details (2)
- 1.22.2-1+b1 · amd64 · trixie
  Affected
  dsa · libnbd · debian · 13
- 1.22.2-1+b1 · arm64 · trixie
  Affected
  dsa · libnbd · debian · 13
[python3-libnbd]Affected
Source package: [libnbd]
Details (2)
- 1.22.2-1+b1 · amd64 · trixie
  Affected
  dsa · libnbd · debian · 13
- 1.22.2-1+b1 · arm64 · trixie
  Affected
  dsa · libnbd · debian · 13

[openSUSE Tumbleweed]

[libnbd0]Unknown
Source package: [libnbd]
Details (1)
- 1.25.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.0-2.1
  Version impact unknown
  dsa · libnbd · opensuse · tumbleweed
[libnbd-bash-completion]Unknown
Source package: [libnbd]
Details (1)
- 1.25.7-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.24.0-2.1
  Version impact unknown
  dsa · libnbd · opensuse · tumbleweed
[libnbd-devel]Unknown
Source package: [libnbd]
Details (1)
- 1.25.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.0-2.1
  Version impact unknown
  dsa · libnbd · opensuse · tumbleweed
[nbdfuse]Unknown
Source package: [libnbd]
Details (1)
- 1.25.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.0-2.1
  Version impact unknown
  dsa · libnbd · opensuse · tumbleweed
[python3-libnbd]Unknown
Source package: [libnbd]
Details (1)
- 1.25.7-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.24.0-2.1
  Version impact unknown
  dsa · libnbd · opensuse · tumbleweed
[libnbd]Fixed
Source package: [libnbd]
Details (1)
- 1.25.7-1.1 · x86_64 · tumbleweed
  Fixed · Fixed: 1.24.0-2.1
  dsa · libnbd · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[libnbd0]Not affected
Source package: [libnbd]
Details (2)
- 1.14.2-1 · amd64 · bookworm
  Not affected
  dsa · libnbd · debian · bookworm
- 1.14.2-1 · arm64 · bookworm
  Not affected
  dsa · libnbd · debian · bookworm
[libnbd-bin]Not affected
Source package: [libnbd]
Details (2)
- 1.14.2-1 · amd64 · bookworm
  Not affected
  dsa · libnbd · debian · bookworm
- 1.14.2-1 · arm64 · bookworm
  Not affected
  dsa · libnbd · debian · bookworm
[libnbd-dev]Not affected
Source package: [libnbd]
Details (2)
- 1.14.2-1 · amd64 · bookworm
  Not affected
  dsa · libnbd · debian · bookworm
- 1.14.2-1 · arm64 · bookworm
  Not affected
  dsa · libnbd · debian · bookworm
[libnbd-ocaml]Not affected
Source package: [libnbd]
Details (2)
- 1.14.2-1 · amd64 · bookworm
  Not affected
  dsa · libnbd · debian · bookworm
- 1.14.2-1 · arm64 · bookworm
  Not affected
  dsa · libnbd · debian · bookworm
[libnbd-ocaml-dev]Not affected
Source package: [libnbd]
Details (2)
- 1.14.2-1 · amd64 · bookworm
  Not affected
  dsa · libnbd · debian · bookworm
- 1.14.2-1 · arm64 · bookworm
  Not affected
  dsa · libnbd · debian · bookworm
[python3-libnbd]Not affected
Source package: [libnbd]
Details (2)
- 1.14.2-1 · amd64 · bookworm
  Not affected
  dsa · libnbd · debian · bookworm
- 1.14.2-1 · arm64 · bookworm
  Not affected
  dsa · libnbd · debian · bookworm

Observed: Oct 24, 2026, 7:59:43 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]