A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-74424 advisory.

    - remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) (RHEL-245282,     CVE-2026-18917)
    - util: virFileChownFiles: do not follow symlinks (CVE-2026-63622)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74424 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917)

    Bug Fix(es) and Enhancement(s):

    * Live migration fails when virtio-vga becomes available, video device switches from virtio-gpu-pci to     virtio-vga on target [rhel-9.8.z] (JIRA:RHEL-186018)

    * libvirt-guests does not work together with virtlockd on shutdown [rhel-9.8.z] (JIRA:RHEL-224986)

    * Expose guest-get-devices in libvirt-api [rhel-9.8.z] (JIRA:RHEL-243306)

    * allow hyperv pvpanic device to process Windows crash dump [rhel-9.8.z] (JIRA:RHEL-242549)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1053 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-18917:
    A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in     the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an     undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer     overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local     privilege escalation.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8831-1 advisory.

    It was discovered that libvirt had an integer overflow vulnerability in the NodeGetFreePages RPC handler.
    A local attacker could possibly use this issue to cause a denial of service or execute arbitrary code.
    (CVE-2026-18917)

    It was discovered that libvirt did not correctly handle symbolic links when changing ownership of the TPM     emulator log file. A local attacker with access to the swtpm account could possibly use this issue to     cause libvirt to change the ownership of an arbitrary file. (CVE-2026-77159)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4004-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4009-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4010-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69114 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69131 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware     platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual     machines using KVM.The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

    * virt:rhel/libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    * virt:rhel/libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68594 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware     platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual     machines using KVM.The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68511 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68510 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68513 advisory.

    Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware     platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual     machines using KVM.The packages also provide APIs for managing and interacting with the virtualized     systems.

    Security Fix(es):

    * qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

    * virt:rhel/libvirt: swtpm privilege escalation via symlink following (CVE-2026-63622)

    * virt:rhel/libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917 )

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68509 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:68514 advisory.

    The libvirt library contains a C API for managing and interacting with the virtualization capabilities of     Linux and other operating systems. In addition, libvirt provides tools for remote management of     virtualized systems.

    Security Fix(es):

    * libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (CVE-2026-18917)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2139 advisory.

    A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in     the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an     undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer     overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local     privilege escalation. (CVE-2026-18917)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3910 advisory.

    A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in     the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an     undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer     overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local     privilege escalation. (CVE-2026-18917)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106766 advisory.

    A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in     the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an     undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer     overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local     privilege escalation.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in     the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an     undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer     overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local     privilege escalation. (CVE-2026-18917)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362692	Oracle Linux 9 : libvirt (ELSA-2026-74424)	Nessus	Oracle Linux Local Security Checks	Local	high
362519	RHEL 9 : libvirt (RHSA-2026:74424)	Nessus	Red Hat Local Security Checks	Local	high
353449	TencentOS Server 4: libvirt (TSSA-2026:1053)	Nessus	Tencent Local Security Checks	Local	high
350949	Ubuntu 24.04 LTS : libvirt vulnerabilities (USN-8831-1)	Nessus	Ubuntu Local Security Checks	Local	high
348452	SUSE SLES15: libvirt / libvirt-client / libvirt-daemon / etc (SUSE-SU-2026:4004-1)	Nessus	SuSE Local Security Checks	Local	high
348448	SUSE SLES15: libvirt / libvirt-client / libvirt-client-qemu / libvirt-daemon / etc (SUSE-SU-2026:4009-1)	Nessus	SuSE Local Security Checks	Local	high
348414	SUSE SLES15: libvirt / libvirt-client / libvirt-client-qemu / libvirt-daemon / etc (SUSE-SU-2026:4010-1)	Nessus	SuSE Local Security Checks	Local	high
348381	RHEL 7 : libvirt (RHSA-2026:69114)	Nessus	Red Hat Local Security Checks	Local	high
348376	RHEL 8 : virt:rhel (RHSA-2026:69131)	Nessus	Red Hat Local Security Checks	Local	high
346923	RHEL 8 : virt:rhel (RHSA-2026:68594)	Nessus	Red Hat Local Security Checks	Local	high
346858	RHEL 9 : libvirt (RHSA-2026:68511)	Nessus	Red Hat Local Security Checks	Local	high
346856	RHEL 10 : libvirt (RHSA-2026:68510)	Nessus	Red Hat Local Security Checks	Local	high
346854	RHEL 8 : virt:rhel (RHSA-2026:68513)	Nessus	Red Hat Local Security Checks	Local	high
346853	RHEL 9 : libvirt (RHSA-2026:68509)	Nessus	Red Hat Local Security Checks	Local	high
346852	RHEL 9 : libvirt (RHSA-2026:68514)	Nessus	Red Hat Local Security Checks	Local	high
345790	Amazon Linux 2023 : libvirt, libvirt-client, libvirt-client-qemu (ALAS2023-2026-2139)	Nessus	Amazon Linux Local Security Checks	Local	high
345778	Amazon Linux 2 : libvirt (ALAS-2026-3910)	Nessus	Amazon Linux Local Security Checks	Local	high
344438	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libvirt (UTSA-2026-106766)	Nessus	Unity Linux Local Security Checks	Local	high
338287	Linux Distros Unpatched Vulnerability : CVE-2026-18917	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-18917

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high