VDB
CVE-2026-61477
CVE-2026-61477
PUBLISHED
CVSS 2.3 LOW
Reported by redhat · Published August 7, 2026
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.
Risk Scores
CVSS 3.1
2.3
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | |
| Red Hat | Red Hat Enterprise Linux 6 | |
| Red Hat | Red Hat Enterprise Linux 7 | |
| Red Hat | Red Hat Enterprise Linux 8 | |
| Red Hat | Red Hat Enterprise Linux 9 | |
| Red Hat | Red Hat Enterprise Linux for NVIDIA 26 | |
| Red Hat | Red Hat Enterprise Linux for NVIDIA 26 | |
| Red Hat | Red Hat Enterprise Linux 6 | |
| Red Hat | Red Hat Enterprise Linux 9 | |
| Red Hat | Red Hat Enterprise Linux 7 | |
| Red Hat | Red Hat Enterprise Linux 8 | |
| Red Hat | Red Hat Enterprise Linux 10 |
Timeline
- Aug 7, 2026 Coalition ESS Score
- Aug 7, 2026 CVE Published
- Aug 7, 2026 CVE Updated
- Aug 8, 2026 EPSS Score
- Aug 9, 2026 Security Advisory
- Aug 24, 2026 EPSS Score
- Aug 31, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
References
- vdb-entryx_refsource_REDHAT
- RHBZ#2512066 issue-trackingx_refsource_REDHAT