CVE-2026-18917
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
A flaw in libvirt allows an unprivileged local user to exploit an integer overflow in the NodeGetFreePages RPC handler, bypassing a size check and leading to a heap buffer overflow. This can corrupt the root libvirt daemon's memory, potentially causing DoS or local privilege escalation.
Risk Assessment
The risk includes local privilege escalation or disruption of libvirt services, threatening system integrity.
Recommendation
Update libvirt to a patched version and restrict local user access to the API.
Other vulnerabilities in libvirt
See all- CVE-2017-1000256High
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of 'verify-peer=no', resulting in a failure to validate SSL/TLS certificates by default.
- CVE-2016-5008Critical
In libvirt versions before 2.0.0, password checking is improperly disabled when the password on a VNC server is set to an empty string. This allows remote attackers to bypass authentication and establish a VNC session by connecting to the server.
- CVE-2026-63622High
A vulnerability was found in libvirt where the virFileChownFiles() function follows symbolic links. A local attacker running as the swtpm user can plant a symlink in the swtpm state directory, causing the root-level libvirt daemon to change ownership of an arbitrary file to the swtpm user.
- CVE-2026-63623Medium
In libvirt, during storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the qemu-img utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines.
- CVE-2026-61477Low
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.
- CVE-2025-13193Medium
A flaw was found in libvirt where external inactive snapshots for shut-down VMs are incorrectly created as world-readable, allowing unprivileged users to inspect guest OS contents. This results in an information disclosure vulnerability.
- CVE-2025-12748Medium
A flaw was discovered in libvirt in the XML file processing. More specifically, the parsing of user provided XML files was performed before the ACL checks. A malicious user with limited permissions could exploit this flaw by submitting a specially crafted XML file, causing libvirt to allocate too much memory on the host. The excessive memory consumption could lead to a libvirt process crash on the host, resulting in a denial-of-service condition.
- CVE-2023-3750Medium
A flaw was found in libvirt where the virStoragePoolObjListSearch function does not return a locked pool as expected, leading to a race condition and denial of service when attempting to lock the same object from another thread.
Original NVD description (English source)
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.