Injection Vulnerability in libvirt's Virtual Network Driver
CVE-2026-61477

2.3LOW

Key Information:

Vendor: Red Hat
Status: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8
Vendor: CVE Published:; 7 August 2026

What is CVE-2026-61477?

An injection vulnerability was identified in the libvirt virtual network driver's XML parser, which fails to adequately sanitize newline characters from DNS TXT record value attributes and SRV record domain or target attributes. This oversight allows users with permissions to define virtual networks to exploit this vulnerability by injecting arbitrary dnsmasq configuration directives into the generated configuration file. Such injections can lead to arbitrary command execution with root privileges, compromising the entire system running the affected libvirt versions.