An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.

ubuntu_linux USN-8652-1: Ubuntu 14.04 LTS / Ubuntu 16.04 LTS / Ubuntu 18.04 LTS / Ubuntu 20.04 LTS / Ubuntu 22.04 LTS / Ubuntu 24.04 LTS / Ubuntu 26.04 LTS / Ubuntu Pro Realtime 22.04 LTS / Ubuntu Pro Realtime 24.04 LTS : libvirt vulnerabilities (USN-8652-1)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1048 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-61477:
    An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not     strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes.
    These values are written verbatim into the dnsmasq configuration file generated by the network driver,     allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration     directives such as dhcp-script, leading to arbitrary command execution as root.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4004-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4009-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4010-1 advisory.

    - CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow     (bsc#1275863).
    - CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive     injection       (bsc#1274576).
    - CVE-2026-63622: `swtpm` privilege escalation via symlink following (bsc#1275264).
    - CVE-2026-63623: information disclosure via world-readable storage volume images during clone/convert     (bsc#1275265).
    - CVE-2026-77159: root `chown()` on `swtpm` logfile follows symlinks (bsc#1274946).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106765 advisory.

    An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not     strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes.
    These values are written verbatim into the dnsmasq configuration file generated by the network driver,     allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration     directives such as dhcp-script, leading to arbitrary command execution as root.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3873 advisory.

    libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection     (CVE-2026-61477)

    libvirt: Check for empty string condition and skip inclusion of the XML document context in the error     message. (CVE-2026-61478)

    A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm`     user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a     symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon     into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation     from the `swtpm` sandbox to root-level file ownership control. (CVE-2026-63622)

    A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume     images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly     permissive file creation settings, allowing any local user to read the full guest disk contents. This     vulnerability could lead to sensitive information disclosure from guest virtual machines. (CVE-2026-63623)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not     strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes.
    These values are written verbatim into the dnsmasq configuration file generated by the network driver,     allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration     directives such as dhcp-script, leading to arbitrary command execution as root. (CVE-2026-61477)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
349541	TencentOS Server 4: libvirt (TSSA-2026:1048)	Nessus	Tencent Local Security Checks	Local	low
348452	SUSE SLES15: libvirt / libvirt-client / libvirt-daemon / etc (SUSE-SU-2026:4004-1)	Nessus	SuSE Local Security Checks	Local	high
348448	SUSE SLES15: libvirt / libvirt-client / libvirt-client-qemu / libvirt-daemon / etc (SUSE-SU-2026:4009-1)	Nessus	SuSE Local Security Checks	Local	high
348414	SUSE SLES15: libvirt / libvirt-client / libvirt-client-qemu / libvirt-daemon / etc (SUSE-SU-2026:4010-1)	Nessus	SuSE Local Security Checks	Local	high
344450	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libvirt (UTSA-2026-106765)	Nessus	Unity Linux Local Security Checks	Local	low
341892	Amazon Linux 2 : libvirt, --advisory ALAS2-2026-3873 (ALAS-2026-3873)	Nessus	Amazon Linux Local Security Checks	Local	high
333192	Linux Distros Unpatched Vulnerability : CVE-2026-61477	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-61477

low

Tenable Plugins

Coming Soon

low

high

high

high

low

high

low