{"id":"CVE-2026-61477","aliases":["AZL-95478","DEBIAN-CVE-2026-61477","EUVD-2026-54487","GHSA-f6jp-rhmm-v59g","OESA-2026-3632","OESA-2026-3633","OESA-2026-3634","OESA-2026-3635","OESA-2026-3832","SUSE-SU-2026:23445-1","SUSE-SU-2026:23460-1","SUSE-SU-2026:23515-1","SUSE-SU-2026:23603-1","SUSE-SU-2026:3939-1","SUSE-SU-2026:4004-1","SUSE-SU-2026:4009-1","SUSE-SU-2026:4010-1","SUSE-SU-2026:4141-1","UBUNTU-CVE-2026-61477","USN-8652-1","USN-8833-1","openSUSE-SU-2026:21738-1"],"status":"published","title":"Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection","description":"An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.","severity":{"version":"3.1","score":2.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00163,"percentile":0.05512,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-93"],"published":"2026-08-07T14:09:23Z","modified":"2026-11-07T10:00:48Z","fixes":[{"ecosystem":"Azure Linux:3","package":"libvirt","fixed_in":["11.9.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libvirt","fixed_in":["11.3.0-3+deb13u3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libvirt","fixed_in":["12.6.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libvirt","fixed_in":["1.3.1-1ubuntu10.31+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libvirt","fixed_in":["4.0.0-1ubuntu8.21+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libvirt","fixed_in":["6.0.0-0ubuntu8.20+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libvirt","fixed_in":["8.0.0-1ubuntu7.19"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libvirt","fixed_in":["10.0.0-2ubuntu8.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libvirt","fixed_in":["12.0.0-1ubuntu5.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libvirt-hwe","fixed_in":["12.0.0-1ubuntu5.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.9.0-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0.0-1","10.0.0-2","10.0.0-3","10.1.0-1","10.10.0-1","10.10.0-2","10.10.0-3","10.10.0-4","10.2.0-1","10.3.0-1","10.3.0-2","10.3.0-3","10.4.0-1","10.5.0-1","10.6.0-1","10.6.0-2","10.6.0-3","10.7.0-1","10.7.0-2","10.7.0-3","10.8.0-1","10.9.0-1","10.9.0-2","11.0.0-1","11.0.0-2","11.1.0-1","11.1.0-2","11.10.0-1","11.10.0-2","11.2.0-1","11.2.0-2","11.2.0-3","11.3.0-1","11.3.0-2","11.3.0-2~bpo12+1","11.3.0-3","11.4.0-1","11.5.0-1","11.6.0-1","11.7.0-1","11.8.0-1","11.8.0-2","11.9.0-1","11.9.0-2","12.0.0-1","12.1.0-1","12.2.0-1","12.3.0-1","12.4.0-1","12.5.0-1","12.6.0-1","12.7.0-1","12.8.0-1","9.0.0-4","9.0.0-4+deb12u1","9.0.0-4+deb12u2","9.1.0-1","9.10.0-1","9.2.0-1","9.2.0-2","9.3.0-1","9.3.0-2","9.4.0-1","9.5.0-1","9.5.0-2","9.6.0-1","9.6.0-2","9.6.0-3","9.7.0-1","9.8.0-1","9.8.0-2","9.9.0-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.3.0-3+deb13u3"}]}],"versions":["11.3.0-3","11.3.0-3+deb13u1","11.3.0-3+deb13u2"]},{"source":"osv","ecosystem":"Debian:14","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.6.0-1"}]}],"versions":["11.10.0-1","11.10.0-2","11.3.0-3","11.4.0-1","11.5.0-1","11.6.0-1","11.7.0-1","11.8.0-1","11.8.0-2","11.9.0-1","11.9.0-2","12.0.0-1","12.1.0-1","12.2.0-1","12.3.0-1","12.4.0-1","12.5.0-1"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-28.oe2003sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-72.oe2203sp4"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10.0-36.oe2403sp1"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10.0-37.oe2403sp3"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.10.0-37.oe2403sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.0-160000.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-slfo.1.1_3.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.0-160000.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.0-160000.5.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.0-150700.4.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.0-150700.4.27.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-150400.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-150400.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-150400.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-150400.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-150400.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-150400.7.17.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-150500.6.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-150500.6.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-150500.6.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-150500.6.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-150500.6.29.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-150600.8.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-150600.8.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-13.48.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-13.48.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1-0ubuntu8","1.1.1-0ubuntu9","1.1.4-0ubuntu2","1.1.4-0ubuntu3","1.1.4-0ubuntu4","1.1.4-0ubuntu5","1.2.0-0ubuntu1","1.2.0-0ubuntu2","1.2.0-0ubuntu3","1.2.1-0ubuntu1","1.2.1-0ubuntu2","1.2.1-0ubuntu3","1.2.1-0ubuntu4","1.2.1-0ubuntu5","1.2.1-0ubuntu7","1.2.1-0ubuntu8","1.2.1-0ubuntu9","1.2.1-0ubuntu10","1.2.2-0ubuntu1","1.2.2-0ubuntu2","1.2.2-0ubuntu3","1.2.2-0ubuntu4","1.2.2-0ubuntu5","1.2.2-0ubuntu6","1.2.2-0ubuntu7","1.2.2-0ubuntu8","1.2.2-0ubuntu9","1.2.2-0ubuntu10","1.2.2-0ubuntu11","1.2.2-0ubuntu12","1.2.2-0ubuntu13","1.2.2-0ubuntu13.1","1.2.2-0ubuntu13.1.1","1.2.2-0ubuntu13.1.2","1.2.2-0ubuntu13.1.4","1.2.2-0ubuntu13.1.5","1.2.2-0ubuntu13.1.6","1.2.2-0ubuntu13.1.7","1.2.2-0ubuntu13.1.8","1.2.2-0ubuntu13.1.9","1.2.2-0ubuntu13.1.10","1.2.2-0ubuntu13.1.12","1.2.2-0ubuntu13.1.14","1.2.2-0ubuntu13.1.16","1.2.2-0ubuntu13.1.17","1.2.2-0ubuntu13.1.20","1.2.2-0ubuntu13.1.21","1.2.2-0ubuntu13.1.22","1.2.2-0ubuntu13.1.23","1.2.2-0ubuntu13.1.25","1.2.2-0ubuntu13.1.26","1.2.2-0ubuntu13.1.27","1.2.2-0ubuntu13.1.28","1.2.2-0ubuntu13.1.28+esm1","1.2.2-0ubuntu13.1.28+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1ubuntu10.31+esm1"}]}],"versions":["1.2.16-2ubuntu11","1.2.16-2ubuntu12","1.2.16-2ubuntu13","1.2.16-2ubuntu14","1.2.21-2ubuntu1","1.2.21-2ubuntu3","1.2.21-2ubuntu4","1.2.21-2ubuntu5","1.2.21-2ubuntu7","1.2.21-2ubuntu8","1.2.21-2ubuntu9","1.2.21-2ubuntu10","1.3.1-1ubuntu1","1.3.1-1ubuntu2","1.3.1-1ubuntu3","1.3.1-1ubuntu4","1.3.1-1ubuntu6","1.3.1-1ubuntu9","1.3.1-1ubuntu10","1.3.1-1ubuntu10.1","1.3.1-1ubuntu10.2","1.3.1-1ubuntu10.3","1.3.1-1ubuntu10.5","1.3.1-1ubuntu10.6","1.3.1-1ubuntu10.7","1.3.1-1ubuntu10.8","1.3.1-1ubuntu10.10","1.3.1-1ubuntu10.11","1.3.1-1ubuntu10.12","1.3.1-1ubuntu10.13","1.3.1-1ubuntu10.14","1.3.1-1ubuntu10.15","1.3.1-1ubuntu10.17","1.3.1-1ubuntu10.18","1.3.1-1ubuntu10.19","1.3.1-1ubuntu10.21","1.3.1-1ubuntu10.22","1.3.1-1ubuntu10.23","1.3.1-1ubuntu10.24","1.3.1-1ubuntu10.25","1.3.1-1ubuntu10.26","1.3.1-1ubuntu10.27","1.3.1-1ubuntu10.29","1.3.1-1ubuntu10.30","1.3.1-1ubuntu10.31"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1ubuntu8.21+esm1"}]}],"versions":["3.6.0-1ubuntu5","3.6.0-1ubuntu6","4.0.0-1ubuntu1","4.0.0-1ubuntu2","4.0.0-1ubuntu3","4.0.0-1ubuntu4","4.0.0-1ubuntu5","4.0.0-1ubuntu6","4.0.0-1ubuntu7","4.0.0-1ubuntu8","4.0.0-1ubuntu8.1","4.0.0-1ubuntu8.2","4.0.0-1ubuntu8.3","4.0.0-1ubuntu8.4","4.0.0-1ubuntu8.5","4.0.0-1ubuntu8.6","4.0.0-1ubuntu8.7","4.0.0-1ubuntu8.8","4.0.0-1ubuntu8.9","4.0.0-1ubuntu8.10","4.0.0-1ubuntu8.11","4.0.0-1ubuntu8.12","4.0.0-1ubuntu8.13","4.0.0-1ubuntu8.14","4.0.0-1ubuntu8.15","4.0.0-1ubuntu8.16","4.0.0-1ubuntu8.17","4.0.0-1ubuntu8.19","4.0.0-1ubuntu8.20","4.0.0-1ubuntu8.21"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-0ubuntu8.20+esm1"}]}],"versions":["5.4.0-0ubuntu5","6.0.0-0ubuntu1","6.0.0-0ubuntu2","6.0.0-0ubuntu3","6.0.0-0ubuntu4","6.0.0-0ubuntu5","6.0.0-0ubuntu6","6.0.0-0ubuntu7","6.0.0-0ubuntu8","6.0.0-0ubuntu8.1","6.0.0-0ubuntu8.2","6.0.0-0ubuntu8.3","6.0.0-0ubuntu8.4","6.0.0-0ubuntu8.5","6.0.0-0ubuntu8.7","6.0.0-0ubuntu8.8","6.0.0-0ubuntu8.9","6.0.0-0ubuntu8.10","6.0.0-0ubuntu8.11","6.0.0-0ubuntu8.12","6.0.0-0ubuntu8.13","6.0.0-0ubuntu8.14","6.0.0-0ubuntu8.15","6.0.0-0ubuntu8.16","6.0.0-0ubuntu8.19","6.0.0-0ubuntu8.20"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-1ubuntu7.19"}]}],"versions":["7.6.0-0ubuntu1","7.6.0-0ubuntu3","8.0.0-1ubuntu3","8.0.0-1ubuntu4","8.0.0-1ubuntu5","8.0.0-1ubuntu6","8.0.0-1ubuntu7","8.0.0-1ubuntu7.1","8.0.0-1ubuntu7.2","8.0.0-1ubuntu7.3","8.0.0-1ubuntu7.4","8.0.0-1ubuntu7.5","8.0.0-1ubuntu7.6","8.0.0-1ubuntu7.7","8.0.0-1ubuntu7.8","8.0.0-1ubuntu7.9","8.0.0-1ubuntu7.10","8.0.0-1ubuntu7.11","8.0.0-1ubuntu7.12","8.0.0-1ubuntu7.13","8.0.0-1ubuntu7.14","8.0.0-1ubuntu7.15","8.0.0-1ubuntu7.16","8.0.0-1ubuntu7.17","8.0.0-1ubuntu7.18"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-2ubuntu8.16"}]}],"versions":["9.6.0-1ubuntu1","9.6.0-1ubuntu2","10.0.0-1ubuntu1","10.0.0-2ubuntu1","10.0.0-2ubuntu5","10.0.0-2ubuntu7","10.0.0-2ubuntu8","10.0.0-2ubuntu8.1","10.0.0-2ubuntu8.2","10.0.0-2ubuntu8.3","10.0.0-2ubuntu8.4","10.0.0-2ubuntu8.5","10.0.0-2ubuntu8.6","10.0.0-2ubuntu8.7","10.0.0-2ubuntu8.8","10.0.0-2ubuntu8.9","10.0.0-2ubuntu8.10","10.0.0-2ubuntu8.11","10.0.0-2ubuntu8.12","10.0.0-2ubuntu8.13","10.0.0-2ubuntu8.14","10.0.0-2ubuntu8.15"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.0-1ubuntu5.3"}]}],"versions":["11.6.0-1ubuntu3","11.6.0-1ubuntu5","11.6.0-1ubuntu6","11.6.0-1ubuntu7","11.6.0-1ubuntu8","12.0.0-1ubuntu3","12.0.0-1ubuntu5","12.0.0-1ubuntu5.1","12.0.0-1ubuntu5.2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libvirt-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.0-1ubuntu5.5"}]}],"versions":["12.0.0-1ubuntu5","12.0.0-1ubuntu5.1","12.0.0-1ubuntu5.2","12.0.0-1ubuntu5.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2-0ubuntu13.1.28+esm2"}]}],"versions":["1.1.1-0ubuntu8","1.1.1-0ubuntu9","1.1.4-0ubuntu2","1.1.4-0ubuntu3","1.1.4-0ubuntu4","1.1.4-0ubuntu5","1.2.0-0ubuntu1","1.2.0-0ubuntu2","1.2.0-0ubuntu3","1.2.1-0ubuntu1","1.2.1-0ubuntu2","1.2.1-0ubuntu3","1.2.1-0ubuntu4","1.2.1-0ubuntu5","1.2.1-0ubuntu7","1.2.1-0ubuntu8","1.2.1-0ubuntu9","1.2.1-0ubuntu10","1.2.2-0ubuntu1","1.2.2-0ubuntu2","1.2.2-0ubuntu3","1.2.2-0ubuntu4","1.2.2-0ubuntu5","1.2.2-0ubuntu6","1.2.2-0ubuntu7","1.2.2-0ubuntu8","1.2.2-0ubuntu9","1.2.2-0ubuntu10","1.2.2-0ubuntu11","1.2.2-0ubuntu12","1.2.2-0ubuntu13","1.2.2-0ubuntu13.1","1.2.2-0ubuntu13.1.1","1.2.2-0ubuntu13.1.2","1.2.2-0ubuntu13.1.4","1.2.2-0ubuntu13.1.5","1.2.2-0ubuntu13.1.6","1.2.2-0ubuntu13.1.7","1.2.2-0ubuntu13.1.8","1.2.2-0ubuntu13.1.9","1.2.2-0ubuntu13.1.10","1.2.2-0ubuntu13.1.12","1.2.2-0ubuntu13.1.14","1.2.2-0ubuntu13.1.16","1.2.2-0ubuntu13.1.17","1.2.2-0ubuntu13.1.20","1.2.2-0ubuntu13.1.21","1.2.2-0ubuntu13.1.22","1.2.2-0ubuntu13.1.23","1.2.2-0ubuntu13.1.25","1.2.2-0ubuntu13.1.26","1.2.2-0ubuntu13.1.27","1.2.2-0ubuntu13.1.28","1.2.2-0ubuntu13.1.28+esm1"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1ubuntu10.31+esm1"}]}],"versions":["1.2.16-2ubuntu11","1.2.16-2ubuntu12","1.2.16-2ubuntu13","1.2.16-2ubuntu14","1.2.21-2ubuntu1","1.2.21-2ubuntu3","1.2.21-2ubuntu4","1.2.21-2ubuntu5","1.2.21-2ubuntu7","1.2.21-2ubuntu8","1.2.21-2ubuntu9","1.2.21-2ubuntu10","1.3.1-1ubuntu1","1.3.1-1ubuntu2","1.3.1-1ubuntu3","1.3.1-1ubuntu4","1.3.1-1ubuntu6","1.3.1-1ubuntu9","1.3.1-1ubuntu10","1.3.1-1ubuntu10.1","1.3.1-1ubuntu10.2","1.3.1-1ubuntu10.3","1.3.1-1ubuntu10.5","1.3.1-1ubuntu10.6","1.3.1-1ubuntu10.7","1.3.1-1ubuntu10.8","1.3.1-1ubuntu10.10","1.3.1-1ubuntu10.11","1.3.1-1ubuntu10.12","1.3.1-1ubuntu10.13","1.3.1-1ubuntu10.14","1.3.1-1ubuntu10.15","1.3.1-1ubuntu10.17","1.3.1-1ubuntu10.18","1.3.1-1ubuntu10.19","1.3.1-1ubuntu10.21","1.3.1-1ubuntu10.22","1.3.1-1ubuntu10.23","1.3.1-1ubuntu10.24","1.3.1-1ubuntu10.25","1.3.1-1ubuntu10.26","1.3.1-1ubuntu10.27","1.3.1-1ubuntu10.29","1.3.1-1ubuntu10.30","1.3.1-1ubuntu10.31"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-1ubuntu8.21+esm1"}]}],"versions":["3.6.0-1ubuntu5","3.6.0-1ubuntu6","4.0.0-1ubuntu1","4.0.0-1ubuntu2","4.0.0-1ubuntu3","4.0.0-1ubuntu4","4.0.0-1ubuntu5","4.0.0-1ubuntu6","4.0.0-1ubuntu7","4.0.0-1ubuntu8","4.0.0-1ubuntu8.1","4.0.0-1ubuntu8.2","4.0.0-1ubuntu8.3","4.0.0-1ubuntu8.4","4.0.0-1ubuntu8.5","4.0.0-1ubuntu8.6","4.0.0-1ubuntu8.7","4.0.0-1ubuntu8.8","4.0.0-1ubuntu8.9","4.0.0-1ubuntu8.10","4.0.0-1ubuntu8.11","4.0.0-1ubuntu8.12","4.0.0-1ubuntu8.13","4.0.0-1ubuntu8.14","4.0.0-1ubuntu8.15","4.0.0-1ubuntu8.16","4.0.0-1ubuntu8.17","4.0.0-1ubuntu8.19","4.0.0-1ubuntu8.20","4.0.0-1ubuntu8.21"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-0ubuntu8.20+esm1"}]}],"versions":["5.4.0-0ubuntu5","6.0.0-0ubuntu1","6.0.0-0ubuntu2","6.0.0-0ubuntu3","6.0.0-0ubuntu4","6.0.0-0ubuntu5","6.0.0-0ubuntu6","6.0.0-0ubuntu7","6.0.0-0ubuntu8","6.0.0-0ubuntu8.1","6.0.0-0ubuntu8.2","6.0.0-0ubuntu8.3","6.0.0-0ubuntu8.4","6.0.0-0ubuntu8.5","6.0.0-0ubuntu8.7","6.0.0-0ubuntu8.8","6.0.0-0ubuntu8.9","6.0.0-0ubuntu8.10","6.0.0-0ubuntu8.11","6.0.0-0ubuntu8.12","6.0.0-0ubuntu8.13","6.0.0-0ubuntu8.14","6.0.0-0ubuntu8.15","6.0.0-0ubuntu8.16","6.0.0-0ubuntu8.19","6.0.0-0ubuntu8.20"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.0-1ubuntu7.19"}]}],"versions":["7.6.0-0ubuntu1","7.6.0-0ubuntu3","8.0.0-1ubuntu3","8.0.0-1ubuntu4","8.0.0-1ubuntu5","8.0.0-1ubuntu6","8.0.0-1ubuntu7","8.0.0-1ubuntu7.1","8.0.0-1ubuntu7.2","8.0.0-1ubuntu7.3","8.0.0-1ubuntu7.4","8.0.0-1ubuntu7.5","8.0.0-1ubuntu7.6","8.0.0-1ubuntu7.7","8.0.0-1ubuntu7.8","8.0.0-1ubuntu7.9","8.0.0-1ubuntu7.10","8.0.0-1ubuntu7.11","8.0.0-1ubuntu7.12","8.0.0-1ubuntu7.13","8.0.0-1ubuntu7.14","8.0.0-1ubuntu7.15","8.0.0-1ubuntu7.16","8.0.0-1ubuntu7.17","8.0.0-1ubuntu7.18"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.0-2ubuntu8.16"}]}],"versions":["9.6.0-1ubuntu1","9.6.0-1ubuntu2","10.0.0-1ubuntu1","10.0.0-2ubuntu1","10.0.0-2ubuntu5","10.0.0-2ubuntu7","10.0.0-2ubuntu8","10.0.0-2ubuntu8.1","10.0.0-2ubuntu8.2","10.0.0-2ubuntu8.3","10.0.0-2ubuntu8.4","10.0.0-2ubuntu8.5","10.0.0-2ubuntu8.6","10.0.0-2ubuntu8.7","10.0.0-2ubuntu8.8","10.0.0-2ubuntu8.9","10.0.0-2ubuntu8.10","10.0.0-2ubuntu8.11","10.0.0-2ubuntu8.12","10.0.0-2ubuntu8.13","10.0.0-2ubuntu8.14","10.0.0-2ubuntu8.15"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.0-1ubuntu5.3"}]}],"versions":["11.6.0-1ubuntu3","11.6.0-1ubuntu5","11.6.0-1ubuntu6","11.6.0-1ubuntu7","11.6.0-1ubuntu8","12.0.0-1ubuntu3","12.0.0-1ubuntu5","12.0.0-1ubuntu5.1","12.0.0-1ubuntu5.2"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libvirt-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.0-1ubuntu5.5"}]}],"versions":["12.0.0-1ubuntu5","12.0.0-1ubuntu5.1","12.0.0-1ubuntu5.2","12.0.0-1ubuntu5.3"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.4.0-160000.5.1"}]}],"bundled":5}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux for nvidia 26"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-61477","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512066","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://gitlab.com/libvirt/libvirt/-/commit/3cfc77963b512d809348fca07f97fe924fac9a05","tags":["fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61477","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-f6jp-rhmm-v59g"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61477.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-61477","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3632","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18917","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63622","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3633","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3634","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3635","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3832","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63623","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623445-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1258345","tags":["report"]},{"url":"https://bugzilla.suse.com/1274576","tags":["report"]},{"url":"https://bugzilla.suse.com/1274946","tags":["report"]},{"url":"https://bugzilla.suse.com/1275264","tags":["report"]},{"url":"https://bugzilla.suse.com/1275265","tags":["report"]},{"url":"https://bugzilla.suse.com/1275863","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-61477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-77159","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623460-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623515-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623603-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263939-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266364","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264004-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264009-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264010-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264141-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-61477","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-61477","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512068","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8652-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8833-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-4147","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-1441","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-2494","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-2496","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-13193","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-61478","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63622","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-63623","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-18917","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-77159","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-61477","title":"Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection","description":"An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.","status":"published","published":"2026-08-07T14:09:23.058Z","modified":"2026-11-06T19:08:41.712Z","cvss":[{"version":"3.1","score":2.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-93"],"updated_at":"2026-11-06T20:30:05.028126Z"}],"euvd":[{"id":"EUVD-2026-54487","description":"An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.","status":"published","published":"2026-08-07T14:09:23Z","modified":"2026-11-06T19:08:41Z","cvss":[{"version":"3.1","score":2.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-06T20:06:05.048214Z"}],"ghsa":[{"id":"GHSA-f6jp-rhmm-v59g","title":"An injection vulnerability was found in libvirt's virtual network driver. The network XML parser...","description":"An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.","status":"published","published":"2026-08-07T15:33:18Z","modified":"2026-08-07T15:33:31Z","cvss":[{"version":"3.1","score":2.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-93"],"updated_at":"2026-11-02T15:10:11.66732Z"}],"nvd":[{"id":"CVE-2026-61477","description":"An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.","status":"published","published":"2026-08-07T14:17:00.187Z","modified":"2026-11-06T19:17:53.29Z","cvss":[{"version":"3.1","score":2.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-93"],"updated_at":"2026-11-06T22:02:12.917468Z"}],"osv":[{"id":"CVE-2026-61477","title":"Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection","description":"An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.","status":"published","published":"2026-08-07T14:09:23.058Z","modified":"2026-11-08T07:14:00.604699062Z","cvss":[{"version":"3.1","score":2.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-93"],"updated_at":"2026-11-07T11:15:38.581573Z"},{"id":"DEBIAN-CVE-2026-61477","description":"An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.","status":"published","published":"2026-08-07T14:17:00.187Z","modified":"2026-11-07T10:00:48.007705442Z","cvss":[{"version":"3.1","score":2.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-07T10:14:19.880839Z"},{"id":"OESA-2026-3632","title":"libvirt security update","description":"Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon\u0026apos;s memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917)\n\nAn injection vulnerability was found in libvirt\u0026apos;s virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477)\n\nA flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.(CVE-2026-63622)","status":"published","published":"2026-09-05T15:03:20Z","modified":"2026-09-05T15:16:26.807040017Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3633","title":"libvirt security update","description":"Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon\u0026apos;s memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917)\n\nAn injection vulnerability was found in libvirt\u0026apos;s virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477)\n\nA flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.(CVE-2026-63622)","status":"published","published":"2026-09-05T15:03:20Z","modified":"2026-09-05T15:16:27.36186852Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3634","title":"libvirt security update","description":"Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon\u0026apos;s memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917)\n\nAn injection vulnerability was found in libvirt\u0026apos;s virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477)\n\nA flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.(CVE-2026-63622)","status":"published","published":"2026-09-05T15:03:21Z","modified":"2026-09-05T15:16:27.372761707Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3635","title":"libvirt security update","description":"Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon\u0026apos;s memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917)\n\nAn injection vulnerability was found in libvirt\u0026apos;s virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477)\n\nA flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.(CVE-2026-63622)","status":"published","published":"2026-09-05T15:03:21Z","modified":"2026-09-05T15:16:27.377565929Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.217107Z"},{"id":"OESA-2026-3832","title":"libvirt security update","description":"Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux (and other OSes). The main package includes the libvirtd server exporting the virtualization support.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon\u0026apos;s memory, potentially leading to a denial of service or local privilege escalation.(CVE-2026-18917)\n\nAn injection vulnerability was found in libvirt\u0026apos;s virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.(CVE-2026-61477)\n\nA flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.(CVE-2026-63622)\n\nA flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.(CVE-2026-63623)","status":"published","published":"2026-09-14T16:34:48Z","modified":"2026-09-13T16:45:48.720531135Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:47.643553Z"},{"id":"UBUNTU-CVE-2026-61477","description":"An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.","status":"published","published":"2026-08-07T14:17:00Z","modified":"2026-09-28T17:41:54.579251192Z","cvss":[{"version":"3.1","score":2.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"AZL-95478","title":"CVE-2026-61477 affecting package libvirt for versions less than 11.9.0-1","description":"An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.","status":"published","published":"2026-08-07T14:17:00Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:26.077208Z"},{"id":"openSUSE-SU-2026:21738-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: integer overflow in `NodeGetFreePages` RPC handler leads to heap buffer overflow and allows for\n  possible local privilege escalation (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows for `dnsmasq` configuration directive\n  injection and can lead to arbitrary code execution as root (bsc#1274576).\n- CVE-2026-63622: symlink-following in `virFileChownFiles()` allows `swtpm` user to trick the root-level `libvirt`\n  daemon into changing the ownership of an arbitrary file and can lead to privilege escalation (bsc#1275264).\n- CVE-2026-63623: newly created volume images are temporarily world-readable during clone/convert operations, which can\n  lead to sensitive information disclosure (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks and allows for root-owned file ownership changes,\n  which can lead to privilege escalation (bsc#1274946).\n","status":"published","published":"2026-09-02T09:43:39Z","modified":"2026-09-09T18:23:13.514876254Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23445-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection\n  (bsc#1274576).\n- CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).\n- CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).\n\nChanges for libvirt:\n\n- rpc: avoid leak of GSource in use for interrupting main loop\n bsc#1258345\n","status":"published","published":"2026-09-02T09:40:30Z","modified":"2026-09-14T18:23:11.20611883Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23460-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: integer overflow in `NodeGetFreePages` RPC handler leads to heap buffer overflow and allows for\n  possible local privilege escalation (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows for `dnsmasq` configuration directive\n  injection and can lead to arbitrary code execution as root (bsc#1274576).\n- CVE-2026-63622: symlink-following in `virFileChownFiles()` allows `swtpm` user to trick the root-level `libvirt`\n  daemon into changing the ownership of an arbitrary file and can lead to privilege escalation (bsc#1275264).\n- CVE-2026-63623: newly created volume images are temporarily world-readable during clone/convert operations, which can\n  lead to sensitive information disclosure (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks and allows for root-owned file ownership changes,\n  which can lead to privilege escalation (bsc#1274946).\n","status":"published","published":"2026-09-02T09:40:54Z","modified":"2026-09-14T18:23:16.683596226Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23515-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection\n  (bsc#1274576).\n- CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).\n- CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).\n","status":"published","published":"2026-09-02T09:15:59Z","modified":"2026-09-15T18:23:08.893661968Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:23603-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: integer overflow in `NodeGetFreePages` RPC handler leads to heap buffer overflow and allows for\n  possible local privilege escalation (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows for `dnsmasq` configuration directive\n  injection and can lead to arbitrary code execution as root (bsc#1274576).\n- CVE-2026-63622: symlink-following in `virFileChownFiles()` allows `swtpm` user to trick the root-level `libvirt`\n  daemon into changing the ownership of an arbitrary file and can lead to privilege escalation (bsc#1275264).\n- CVE-2026-63623: newly created volume images are temporarily world-readable during clone/convert operations, which can\n  lead to sensitive information disclosure (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks and allows for root-owned file ownership changes,\n  which can lead to privilege escalation (bsc#1274946).\n","status":"published","published":"2026-09-02T09:40:54Z","modified":"2026-09-29T18:23:19.004436484Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3939-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: remote: Fix integer overflow in RPC handler for virNodeGetFreePages (bsc#1275863)\n- CVE-2026-63622: util: virFileChownFiles: do not follow symlinks (bsc#1275264)\n- CVE-2026-63623: storage: create images with a private umask during qemu-img create/convert (bsc#12075265)\n- CVE-2026-77159: qemu: tpm: Avoid following symlinks when chown'ing log file (bsc#1274946)\n- CVE-2026-61477: Reject line breaks in network config (bsc#1274576)\n- qemu: Fix invocation of numa-preplace when hugepages requested, but page size not specified (bsc#1266364)\n- Add ClearwaterForest CPU model (jsc#PED-16192)\n","status":"published","published":"2026-09-03T07:32:04Z","modified":"2026-09-10T18:23:18.060995579Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4004-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection\n  (bsc#1274576).\n- CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).\n- CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).\n","status":"published","published":"2026-09-07T07:30:37Z","modified":"2026-09-13T18:23:14.56483128Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4009-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection\n  (bsc#1274576).\n- CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).\n- CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).\n","status":"published","published":"2026-09-07T07:33:47Z","modified":"2026-09-13T18:23:15.157335781Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4010-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection\n  (bsc#1274576).\n- CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).\n- CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).\n","status":"published","published":"2026-09-07T07:34:04Z","modified":"2026-09-13T18:23:15.168339372Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4141-1","title":"Security update for libvirt","description":"This update for libvirt fixes the following issues:\n\n- CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow (bsc#1275863).\n- CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection\n  (bsc#1274576).\n- CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).\n- CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert (bsc#1275265).\n- CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).\n","status":"published","published":"2026-09-14T07:58:58Z","modified":"2026-09-28T18:23:12.648589568Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8652-1","title":"libvirt vulnerabilities","description":"It was discovered that libvirt incorrectly handled guest reboots in the\nlibxl driver. An attacker in a guest could possibly use this issue to\ncause the libvirt daemon to crash, resulting in a denial of service. This\nissue only affected Ubuntu 16.04 LTS. (CVE-2021-4147)\n\nAlexander Kuznetsov discovered that libvirt incorrectly handled listing\nnetwork interfaces. An attacker could possibly use this issue to cause\nthe libvirt daemon to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.\n(CVE-2024-1441)\n\nIt was discovered that libvirt incorrectly handled certain values in its\nRPC library. An attacker could possibly use this issue to cause the\nlibvirt daemon to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.\n(CVE-2024-2494)\n\nIt was discovered that libvirt incorrectly handled listing network\ninterfaces under certain circumstances. An attacker could possibly use\nthis issue to cause the libvirt daemon to crash, resulting in a denial of\nservice. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and\nUbuntu 18.04 LTS. (CVE-2024-2496)\n\nIt was discovered that libvirt incorrectly set permissions on external\ninactive snapshots, making them world-readable. A local attacker could\npossibly use this issue to obtain sensitive information. This issue only\naffected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu\n20.04 LTS. (CVE-2025-13193)\n\nIt was discovered that libvirt incorrectly handled certain characters in\nvirtual network definitions. An authenticated user could possibly use\nthis issue to inject arbitrary configuration directives and execute\narbitrary code as root. This issue did not affect Ubuntu 14.04 LTS.\n(CVE-2026-61477)\n\nIt was discovered that libvirt incorrectly handled certain XML input. An\nattacker could possibly use this issue to cause the libvirt daemon to\ncrash, resulting in a denial of service. (CVE-2026-61478)\n\nHe Wei discovered that libvirt incorrectly followed symbolic links when\nchanging file ownership. A local attacker could possibly use this issue\nto escalate privileges. This issue only affected Ubuntu 20.04 LTS, Ubuntu\n22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63622)\n\nIt was discovered that libvirt incorrectly set permissions on images\nduring storage volume clone and convert operations, making them\ntemporarily world-readable. A local attacker could possibly use this\nissue to obtain sensitive information. (CVE-2026-63623)","status":"published","published":"2026-08-19T16:56:44Z","modified":"2026-08-20T05:29:28.368157919Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8833-1","title":"libvirt-hwe vulnerabilities","description":"It was discovered that libvirt did not properly validate newline characters\nin DNS TXT record values and SRV record attributes in its virtual network\ndriver. A local attacker with permission to define virtual networks could\npossibly use this issue to inject arbitrary dnsmasq configuration\ndirectives, leading to arbitrary command execution as root.\n(CVE-2026-61477)\n\nIt was discovered that libvirt did not properly handle errors during XML\ncontext parsing. An attacker could possibly use this issue to cause libvirt\nto crash, resulting in a denial of service. (CVE-2026-61478)\n\nHe Wei discovered that libvirt had a symlink-following vulnerability in the\nfile ownership change function used for virtual TPM state directories. A\nlocal attacker running as the swtpm user could possibly use this issue to\ncause libvirt to change the ownership of an arbitrary file, leading to\nprivilege escalation. (CVE-2026-63622)\n\nIt was discovered that libvirt created storage volume images with overly\npermissive permissions during clone or convert operations. A local attacker\ncould possibly use this issue to read guest disk contents, resulting in\ninformation disclosure. (CVE-2026-63623)\n\nIt was discovered that libvirt had an integer overflow in the\nNodeGetFreePages RPC handler. A local attacker could possibly use this\nissue to cause libvirt to crash or execute arbitrary code.\n(CVE-2026-18917)\n\nIt was discovered that libvirt had a symlink-following flaw in the virtual\nTPM emulator setup function. A local attacker with access to the swtpm\naccount could possibly use this issue to cause libvirt to change the\nownership of an arbitrary file, leading to privilege escalation.\n(CVE-2026-77159)","status":"published","published":"2026-09-28T11:57:56Z","modified":"2026-09-28T17:42:51.297248796Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}