CVE-2026-61477: libvirt CRLF Injection
Vulnerability summary
CVE-2026-61477 is a low (CVSS 2.3) CRLF Injection vulnerability in libvirt. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 5.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 12 · Related 12Timeline
- 07-08-2026PublishedVulnerability first disclosed.
- 07-08-2026Last modifiedVulnerability information updated.
Description
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated2.3LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated2.3LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- NVDNIST2.3LowCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.16%
Chance of exploitation in the next 30 days
Percentile
5%
Versus all other CVEs
30-day change
0.00 pp
From 0.16% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu2 products
- libvirtAll versions (No fix recorded) | < 1.3.1-1ubuntu10.31+esm1 | < 4.0.0-1ubuntu8.21+esm1 | < 6.0.0-0ubuntu8.20+esm1 | < 8.0.0-1ubuntu7.19 | < 10.0.0-2ubuntu8.16 | < 12.0.0-1ubuntu5.3
- libvirt-hwe< 12.0.0-1ubuntu5.5
Debian1 product
- libvirtAll versions (No fix recorded) | < 11.3.0-3+deb13u3 | < 12.6.0-1
2 vendors · 3 products
