Detections
Analytics
Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.1.1)
high Nessus Plugin ID 314327
Synopsis
The Nutanix AHV host is affected by multiple vulnerabilities .Description
The version of AHV installed on the remote host is prior to AHV-11.0.1.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-11.0.1.1 advisory.- LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer.
The images that trigger this vulnerability are valid per the PNG specification. This vulnerability is fixed in 1.6.55. (CVE-2026-25646)
- In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.) (CVE-2025-68973)
- In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly. (CVE-2026-31431)
- A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string. (CVE-2025-13601)
- When building nested elements using xml.dom.minidom methods such as appendChild() that have a dependency on _clear_id_cache() the algorithm is quadratic. Availability can be impacted when building excessively nested documents. (CVE-2025-12084)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the Nutanix AHV software to the recommended version. Before upgrading: if this cluster is registered with Prism Central, ensure that Prism Central has been upgraded first to a compatible version. Refer to the Software Product Interoperability page on the Nutanix portal.See Also
Plugin Details
Severity: High
ID: 314327
File Name: nutanix_NXSA-AHV-11_0_1_1.nasl
Version: 1.1
Type: Local
Family: Misc.
Published: 5/12/2026
Updated: 5/12/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.5
CVSS v2
Risk Factor: High
Base Score: 7.6
Temporal Score: 6.6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-25646
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.3
Threat Score: 8.3
Threat Vector: CVSS:4.0/E:A
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
CPE: cpe:/o:nutanix:ahv
Required KB Items: Host/Nutanix/Data/Node/Version, Host/Nutanix/Data/Node/Type
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 5/12/2026
Vulnerability Publication Date: 4/9/2024
CISA Known Exploited Vulnerability Due Dates: 5/15/2026
Reference Information
CVE: CVE-2025-12084, CVE-2025-13601, CVE-2025-15467, CVE-2025-6176, CVE-2025-68973, CVE-2025-69419, CVE-2026-0994, CVE-2026-22695, CVE-2026-22801, CVE-2026-25646, CVE-2026-31431