CVEvulnerability

CVE-2026-61477

2.3 LOW Published 2026-08-07 Modified 2026-08-14 Official page ↗
Status
Awaiting Analysis
Published
2026-08-07
Last modified
2026-08-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.3 LOW — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-93

Description

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.

Related

Weakness · CWE (1)

  • CWE-93 Improper Neutralization of CRLF Sequences weakness

References