Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Libvirt may let local user gain admin rights

CVE-2026-18917 · published 2 months ago
Summary

The libvirt program used on several Linux distributions can be tricked by an unprivileged user into writing data past a memory buffer. This can crash the service or let the user increase their privileges on the system. Apply the latest libvirt updates from your Linux vendor to fix the issue.

What to do
  • Update bellsoft libvirt to version 8.9.0-r9.
  • Update bellsoft libvirt to version 11.3.0-r4.
  • Update bellsoft libvirt to version 12.6.0-r1.
  • Update debian libvirt to version 11.3.0-3+deb13u3.
  • Update debian libvirt to version 12.7.0-1.
  • Update canonical libvirt to version 8.0.0-1ubuntu7.21.
  • Update canonical libvirt to version 10.0.0-2ubuntu8.19.
  • Update canonical libvirt to version 12.0.0-1ubuntu5.5.
  • Update canonical libvirt-hwe to version 12.0.0-1ubuntu5.5.
Affected software
Ecosystem VendorProductAffected versions
Ubuntu:Pro:14.04:LTS canonical libvirt All versions
Ubuntu:Pro:16.04:LTS canonical libvirt All versions
Alpaquita:23 bellsoft libvirt >= 8.9.0-r4, < 8.9.0-r9
Fix: upgrade to 8.9.0-r9
Alpaquita:25 bellsoft libvirt >= 11.3.0-r0, < 11.3.0-r4
Fix: upgrade to 11.3.0-r4
Ubuntu:26.04:LTS canonical libvirt-hwe < 12.0.0-1ubuntu5.5
Fix: upgrade to 12.0.0-1ubuntu5.5
– red hat red hat enterprise linux 10 All versions
– red hat red hat enterprise linux 6 All versions
– red hat red hat enterprise linux 7 All versions
– red hat red hat enterprise linux 8 All versions
– red hat red hat enterprise linux 9 All versions
– red hat red hat enterprise linux for nvidia 26 All versions
Debian:11 debian libvirt All versions
Debian:12 debian libvirt All versions
Debian:13 debian libvirt < 11.3.0-3+deb13u3
Fix: upgrade to 11.3.0-3+deb13u3
Debian:14 debian libvirt < 12.7.0-1
Fix: upgrade to 12.7.0-1
Ubuntu:Pro:18.04:LTS canonical libvirt All versions
Ubuntu:Pro:20.04:LTS canonical libvirt All versions
Ubuntu:22.04:LTS canonical libvirt < 8.0.0-1ubuntu7.21
Fix: upgrade to 8.0.0-1ubuntu7.21
Ubuntu:24.04:LTS canonical libvirt < 10.0.0-2ubuntu8.19
Fix: upgrade to 10.0.0-2ubuntu8.19
Ubuntu:26.04:LTS canonical libvirt < 12.0.0-1ubuntu5.5
Fix: upgrade to 12.0.0-1ubuntu5.5
Alpaquita:stream bellsoft libvirt >= 9.1.0-r2, < 12.6.0-r1
Fix: upgrade to 12.6.0-r1
– red hat red hat enterprise linux 10.0 extended update support All versions
– red hat red hat enterprise linux 8.8 telecommunications update service All versions
– red hat red hat enterprise linux 8.8 update services for sap solutions All versions
– red hat red hat enterprise linux 9.2 update services for sap solutions All versions
– red hat red hat enterprise linux 9.4 update services for sap solutions All versions
– red hat red hat enterprise linux 9.6 extended update support All versions
– red hat red hat enterprise linux 8.6 advanced mission critical update support All versions
– red hat red hat enterprise linux 8.6 extended update support long-life add-on All versions
– red hat red hat enterprise linux 7 extended lifecycle support All versions
– red hat red hat enterprise linux 8.4 advanced mission critical update support All versions
– red hat red hat enterprise linux 8.4 extended update support long-life add-on All versions
Original advisory text
Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-190Integer Overflow
Timeline
Published20 Aug 2026
Updated5 Nov 2026
First seen20 Aug 2026
Sources
CVE-2026-18917 · NVD
CVE-2026-18917 · MITRE
DEBIAN-CVE-2026-18917 · OSV
UBUNTU-CVE-2026-18917 · OSV
BELL-CVE-2026-18917 · OSV
Track software like this
Free during beta