The version of libvirt installed on the remote host is prior to 4.5.0-36. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3873 advisory.

    libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection     (CVE-2026-61477)

    libvirt: Check for empty string condition and skip inclusion of the XML document context in the error     message. (CVE-2026-61478)

    A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm`     user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a     symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon     into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation     from the `swtpm` sandbox to root-level file ownership control. (CVE-2026-63622)

    A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume     images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly     permissive file creation settings, allowing any local user to read the full guest disk contents. This     vulnerability could lead to sensitive information disclosure from guest virtual machines. (CVE-2026-63623)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : libvirt, --advisory ALAS2-2026-3873 (ALAS-2026-3873)

high Nessus Plugin ID 341892

Version 1.2

Version 1.1

Version 1.2 Sep 18, 2026, 11:05 PM Plugin metadata (Add IAVM Info) Plugin Feed: 202609182305
Version 1.1 Sep 1, 2026, 5:14 AM New Plugin Feed: 202609010514