An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8652-1 advisory.

    It was discovered that libvirt incorrectly handled guest reboots in the libxl driver. An attacker in a     guest could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of     service. This issue only affected Ubuntu 16.04 LTS. (CVE-2021-4147)

    Alexander Kuznetsov discovered that libvirt incorrectly handled listing network interfaces. An attacker     could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. This     issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-1441)

    It was discovered that libvirt incorrectly handled certain values in its RPC library. An attacker could     possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of service. This issue     only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2024-2494)

    It was discovered that libvirt incorrectly handled listing network interfaces under certain circumstances.
    An attacker could possibly use this issue to cause the libvirt daemon to crash, resulting in a denial of     service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
    (CVE-2024-2496)

    It was discovered that libvirt incorrectly set permissions on external inactive snapshots, making them     world-readable. A local attacker could possibly use this issue to obtain sensitive information. This issue     only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2025-13193)

    It was discovered that libvirt incorrectly handled certain characters in virtual network definitions. An     authenticated user could possibly use this issue to inject arbitrary configuration directives and execute     arbitrary code as root. This issue did not affect Ubuntu 14.04 LTS. (CVE-2026-61477)

    It was discovered that libvirt incorrectly handled certain XML input. An attacker could possibly use this     issue to cause the libvirt daemon to crash, resulting in a denial of service. (CVE-2026-61478)

    He Wei discovered that libvirt incorrectly followed symbolic links when changing file ownership. A local     attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 20.04 LTS,     Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63622)

    It was discovered that libvirt incorrectly set permissions on images during storage volume clone and     convert operations, making them temporarily world-readable. A local attacker could possibly use this issue     to obtain sensitive information. (CVE-2026-63623)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1048 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-61477:
    An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not     strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes.
    These values are written verbatim into the dnsmasq configuration file generated by the network driver,     allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration     directives such as dhcp-script, leading to arbitrary command execution as root.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4004-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4009-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4010-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106765 advisory.

    An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not     strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes.
    These values are written verbatim into the dnsmasq configuration file generated by the network driver,     allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration     directives such as dhcp-script, leading to arbitrary command execution as root.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3873 advisory.

    libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection     (CVE-2026-61477)

    libvirt: Check for empty string condition and skip inclusion of the XML document context in the error     message. (CVE-2026-61478)

    A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm`     user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a     symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon     into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation     from the `swtpm` sandbox to root-level file ownership control. (CVE-2026-63622)

    A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume     images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly     permissive file creation settings, allowing any local user to read the full guest disk contents. This     vulnerability could lead to sensitive information disclosure from guest virtual machines. (CVE-2026-63623)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not     strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes.
    These values are written verbatim into the dnsmasq configuration file generated by the network driver,     allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration     directives such as dhcp-script, leading to arbitrary command execution as root. (CVE-2026-61477)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365450	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libvirt vulnerabilities (USN-8652-1)	Nessus	Ubuntu Local Security Checks	Local	medium
349541	TencentOS Server 4: libvirt (TSSA-2026:1048)	Nessus	Tencent Local Security Checks	Local	low
348452	SUSE SLES15: libvirt / libvirt-client / libvirt-daemon / etc (SUSE-SU-2026:4004-1)	Nessus	SuSE Local Security Checks	Local	high
348448	SUSE SLES15: libvirt / libvirt-client / libvirt-client-qemu / libvirt-daemon / etc (SUSE-SU-2026:4009-1)	Nessus	SuSE Local Security Checks	Local	high
348414	SUSE SLES15: libvirt / libvirt-client / libvirt-client-qemu / libvirt-daemon / etc (SUSE-SU-2026:4010-1)	Nessus	SuSE Local Security Checks	Local	high
344450	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libvirt (UTSA-2026-106765)	Nessus	Unity Linux Local Security Checks	Local	low
341892	Amazon Linux 2 : libvirt, --advisory ALAS2-2026-3873 (ALAS-2026-3873)	Nessus	Amazon Linux Local Security Checks	Local	high
333192	Linux Distros Unpatched Vulnerability : CVE-2026-61477	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-61477

low

Tenable Plugins

medium

low

high

high

high

low

high

low