What is the CVSS score of EUVD-2026-54487?

EUVD-2026-54487 has a CVSS 3.1 base score of 2.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

libvirt EUVD-2026-54487

| CVE-2026-61477 LOW

Improper Neutralization of CRLF Sequences ('CRLF Injection') (CWE-93)

2026-08-07 secalert@redhat.com

GHSA-f6jp-rhmm-v59g

Code Injection

2.3

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

2.3 LOW

AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

8.2 HIGH

Injection escalates to root RCE via dhcp-script beyond the caller's privilege scope, warranting S:C and C/I/A:H despite the PR:H prerequisite.

3.1 AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 14:36 vuln.today

DescriptionCVE.org

An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq configuration file generated by the network driver, allowing a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, leading to arbitrary command execution as root.

AnalysisAI

CRLF injection in libvirt's virtual network driver enables privileged users holding network-definition rights to inject arbitrary dnsmasq configuration directives - including dhcp-script - into the generated dnsmasq config file, ultimately achieving arbitrary command execution as root on the hypervisor host. The root cause is the network XML parser's failure to strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes before writing them verbatim into the dnsmasq configuration. No public exploit has been identified at time of analysis, though an upstream fix commit exists in the libvirt GitLab repository; the official CVSS score of 2.3 appears to critically understate the impact relative to the described root code execution primitive.

Technical ContextAI

libvirt is an open-source API, daemon, and management tool for managing platform virtualization, widely used in KVM/QEMU hypervisor stacks. Its virtual network driver generates dnsmasq configuration files to provide DNS and DHCP services to guest VMs. The vulnerable code path parses virtual network XML definitions and writes DNS TXT record values and SRV record domain/target fields verbatim into the generated dnsmasq config without first sanitizing newline (CRLF) characters. CWE-93 (Improper Neutralization of Special Elements - CRLF Injection) describes exactly this failure mode: an application that writes externally influenced data into a structured configuration format without escaping structural delimiters allows an attacker to break out of the intended field boundary and inject arbitrary new directives. In dnsmasq, the dhcp-script directive specifies an external script executed as root by the dnsmasq process for DHCP lease events, making it the canonical injection target for privilege escalation. The upstream fix is available at GitLab commit 3cfc77963b512d809348fca07f97fe924fac9a05 in the libvirt repository.

Affected ProductsAI

The affected product is libvirt (virtual network driver), reported by Red Hat security (secalert@redhat.com) and tracked in Red Hat Bugzilla at https://bugzilla.redhat.com/show_bug.cgi?id=2512066. Specific affected version ranges are not explicitly stated in the available CVE data; the upstream fix is identified by GitLab commit 3cfc77963b512d809348fca07f97fe924fac9a05 in the libvirt project repository. Affected versions are inferred as all releases prior to the commit merge point. Red Hat's advisory at https://access.redhat.com/security/cve/CVE-2026-61477 should be consulted for specific package versions across RHEL and derivative distributions.

RemediationAI

The primary fix is to apply the upstream libvirt patch available at https://gitlab.com/libvirt/libvirt/-/commit/3cfc77963b512d809348fca07f97fe924fac9a05, which sanitizes newline characters from DNS TXT and SRV record attributes before writing them to the dnsmasq configuration. Red Hat-based distributions (RHEL, CentOS Stream, Fedora) should monitor https://access.redhat.com/security/cve/CVE-2026-61477 for updated libvirt package releases. As a compensating control where patching is not immediately possible, restrict libvirt network-definition permissions exclusively to fully trusted system administrators by auditing and tightening polkit rules and libvirt access controls - this eliminates the untrusted-user attack surface without disabling virtual networking entirely. Trade-off: tightening libvirt ACLs in multi-tenant environments may break delegated self-service network provisioning workflows. An additional defense-in-depth measure is to review existing virtual network XML definitions for unexpected newline characters in DNS TXT values or SRV domain/target fields as an indicator of prior exploitation.