CVE-2026-18917
Full vulnerability record from the local CVENow database.
Description
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.
Severity
HIGH
CVSS score
7.8
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-08-20 10:16:40.507000
Last modified
2026-10-27 10:10:00.240000
View original CVE JSON
{
"id": "CVE-2026-18917",
"sourceIdentifier": "[email protected]",
"published": "2026-08-20T10:16:40.507",
"lastModified": "2026-10-27T10:10:00.240",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation."
},
{
"lang": "es",
"value": "Se encontró un fallo en libvirt. Un usuario local sin privilegios podría explotar una vulnerabilidad de desbordamiento de entero en el gestor RPC NodeGetFreePages. Este fallo permite que valores manipulados eludan una comprobación de tamaño, lo que lleva a un búfer de memoria de tamaño insuficiente. Posteriormente, los datos reales del nodo NUMA pueden sobrescribir este búfer. Este desbordamiento de búfer en el heap puede corromper la memoria del demonio root de libvirt, lo que podría llevar a una denegación de servicio o una escalada de privilegios local."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libvirt",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"versions": [
{
"version": "0:11.10.0-12.9.el10_2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libvirt",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"versions": [
{
"version": "0:10.10.0-8.12.el10_0",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libvirt",
"cpes": [
"cpe:/o:redhat:rhel_els:7"
],
"versions": [
{
"version": "0:4.5.0-36.el7_9.7",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "virt:rhel",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"versions": [
{
"version": "8040020260916092751.522a0ee4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "virt:rhel",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.4::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.4::appstream"
],
"versions": [
{
"version": "8040020260916092751.522a0ee4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "virt:rhel",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"versions": [
{
"version": "8060020260910092451.ad008a3a",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "virt:rhel",
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"versions": [
{
"version": "8060020260910092451.ad008a3a",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "virt:rhel",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"versions": [
{
"version": "8080020260910092120.63b34585",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "virt:rhel",
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"versions": [
{
"version": "8080020260910092120.63b34585",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libvirt",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"versions": [
{
"version": "0:11.10.0-12.7.el9_8",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libvirt",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream"
],
"versions": [
{
"version": "0:9.0.0-10.17.el9_2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libvirt",
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4::appstream"
],
"versions": [
{
"version": "0:10.0.0-6.24.el9_4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libvirt",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::appstream",
"cpe:/a:redhat:rhel_eus:9.6::crb"
],
"versions": [
{
"version": "0:10.10.0-7.19.el9_6",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libvirt",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "virt:rhel/libvirt",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux for NVIDIA 26",
"defaultStatus": "unknown",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "libvirt",
"cpes": [
"cpe:/a:redhat:enterprise_linux_nvidia:"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-08-20T15:33:25.231709Z",
"id": "CVE-2026-18917",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-190"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2026:68509",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:68510",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:68511",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:68513",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:68514",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:68594",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:69114",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:69131",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:74424",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:75583",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2026-18917",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520161",
"source": "[email protected]"
}
]
}