Vulnerability · Published Aug 20, 2026 · Assigned by redhat
CVE-2026-18917Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow
High 7.8
In plain English
A high-severity integer overflow in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 92.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | libvirt | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-client | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-client | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-client-qemu | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-client-qemu | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-common | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-common | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-config-network | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-config-network | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-config-nwfilter | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-config-nwfilter | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-driver-interface | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-driver-interface | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-driver-network | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-driver-network | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-driver-nodedev | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-driver-nodedev | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-driver-nwfilter | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-driver-nwfilter | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-driver-qemu | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-driver-qemu | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-driver-secret | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-driver-secret | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-driver-storage | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-driver-storage | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-driver-storage-core | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-driver-storage-core | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-driver-storage-disk | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-driver-storage-disk | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-driver-storage-iscsi | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-driver-storage-iscsi | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-driver-storage-logical | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-driver-storage-logical | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-driver-storage-mpath | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-driver-storage-mpath | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-driver-storage-rbd | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-driver-storage-rbd | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-driver-storage-scsi | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-driver-storage-scsi | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-kvm | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-kvm | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-lock | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-lock | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-log | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-log | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-plugin-lockd | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-plugin-lockd | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-plugin-sanlock | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-plugin-sanlock | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-daemon-proxy | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-daemon-proxy | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-devel | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-devel | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-docs | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-docs | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-libs | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-libs | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-nss | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-nss | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| AlmaLinux:10 | libvirt-ssh-proxy | 11.10.0-12.9.el10_2.alma.1 | ALSA-2026:75583 |
| AlmaLinux:9 | libvirt-ssh-proxy | 11.10.0-12.7.el9_8.alma.1 | ALSA-2026:74424 |
| Debian:12 | libvirt | no fix listed | DEBIAN-CVE-2026-18917 |
| Debian:13 | libvirt | 11.3.0-3+deb13u3 | DEBIAN-CVE-2026-18917 |
| Debian:14 | libvirt | 12.7.0-1 | DEBIAN-CVE-2026-18917 |
| Rocky Linux:10 | libvirt | 0:11.10.0-12.9.el10_2 | RLSA-2026:75583 |
| Rocky Linux:9 | libvirt | 0:11.10.0-12.7.el9_8 | RLSA-2026:74424 |
| Ubuntu:22.04:LTS | libvirt | 8.0.0-1ubuntu7.21 | UBUNTU-CVE-2026-18917 |
| Ubuntu:22.04:LTS | libvirt | 8.0.0-1ubuntu7.21 | USN-8831-1 |
| Ubuntu:24.04:LTS | libvirt | 10.0.0-2ubuntu8.19 | UBUNTU-CVE-2026-18917 |
| Ubuntu:24.04:LTS | libvirt | 10.0.0-2ubuntu8.19 | USN-8831-1 |
| Ubuntu:26.04:LTS | libvirt | 12.0.0-1ubuntu5.5 | USN-8831-1 |
| Ubuntu:26.04:LTS | libvirt | 12.0.0-1ubuntu5.5 | UBUNTU-CVE-2026-18917 |
| Ubuntu:26.04:LTS | libvirt-hwe | 12.0.0-1ubuntu5.5 | UBUNTU-CVE-2026-18917 |
| Ubuntu:26.04:LTS | libvirt-hwe | 12.0.0-1ubuntu5.5 | USN-8833-1 |
Affected products (as reported)
Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- RHSA-2026:68509 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:68510 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:68511 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:68513 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:68514 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:68594 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:69114 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:69131 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:74424 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:75583 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-18917 vdb-entry, x_refsource_REDHAT
- RHBZ#2520161 issue-tracking, x_refsource_REDHAT