CVE-2026-61477

Name of the Vulnerable Software and Affected Versions libvirt (affected versions not specified)

Description An injection issue exists in the virtual network driver of libvirt. The network XML parser fails to remove newline characters from DNS TXT record value attributes and SRV record domain/target attributes. Because these values are written directly into the generated dnsmasq configuration file, a user with permissions to define virtual networks can inject arbitrary dnsmasq configuration directives, such as dhcp-script, resulting in arbitrary command execution with root privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.