Summary
It was discovered that libvirt did not properly validate newline characters
in DNS TXT record values and SRV record attributes in its virtual network
driver. A local attacker with permission to define virtual networks could
possibly use this issue to inject arbitrary dnsmasq configuration
directives, leading to arbitrary command execution as root.
(CVE-2026-61477)
It was discovered that libvirt did not properly handle errors during XML
context parsing. An attacker could possibly use this issue to cause libvirt
to crash, resulting in a denial of service. (CVE-2026-61478)
He Wei discovered that libvirt had a symlink-following vulnerability in the
file ownership change function used for virtual TPM state directories. A
local attacker running as the swtpm user could possibly use this issue to
cause libvirt to change the ownership of an arbitrary file, leading to
privilege escalation. (CVE-2026-63622)
It was discovered that libvirt created storage volume images with overly
permissive permissions during clone or convert operations. A local attacker
could possibly use this issue to read guest disk contents, resulting in
information disclosure. (CVE-2026-63623)
It was discovered that libvirt had an integer overflow in the
NodeGetFreePages RPC handler. A local attacker could possibly use this
issue to cause libvirt to crash or execute arbitrary code.
(CVE-2026-18917)
It was discovered that libvirt had a symlink-following flaw in the virtual
TPM emulator setup function. A local attacker with access to the swtpm
account could possibly use this issue to cause libvirt to change the
ownership of an arbitrary file, leading to privilege escalation.
(CVE-2026-77159)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 26.04 LTS 26.04:LTS | libvirt-hwe | 12.0.0-1ubuntu5.5 |
Vulnerabilities 5
-
High 7.8
Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUM…
-
High 7.8
Libvirt: swtpm privilege escalation via symlink following
A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, …
-
Medium 5.5
Libvirt: information disclosure via world-readable storage volume images during clone/convert
A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local us…
-
Medium 5.5
Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile w…
-
Low 2.3
Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq…