The oVirt storage backend in Red Hat Enterprise Virtualization 3.4 does not wipe memory snapshots when deleting a VM, even when wipe-after-delete (WAD) is configured for the VM's disk, which allows remote authenticated users with certain credentials to read portions of the deleted VM's memory and obtain sensitive information via an uninitialized storage volume.
Conclusion & alert: CVE-2014-3559 is rated Low Risk (39.5/100): CVSS Low severity, with medium exploitation likelihood (EPSS 1.44%). Core evidence: EPSS rose +1.12% over the last day, indicating growing attacker interest. Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.32% | 1.44% | +1.12% |
| 2 | 2025-03-17 | 0.16% | 0.32% | +0.16% |
| 3 | 2023-03-07 | — | 0.16% | — |
Full EPSS history (6 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 3.5 | 2.0 | LOW |
|
6.8 | 2.9 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2014-3559 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| redhat | enterprise_virtualization | 3.4 | cpe:2.3:a:redhat:enterprise_virtualization:3.4:*:*:*:*:*:*:* |