A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Redhat |
|
No data.
No data.
References
History
Mon, 05 Oct 2026 09:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/o:redhat:enterprise_linux:10.2 | |
| References |
|
Fri, 02 Oct 2026 04:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb |
|
| References |
|
Mon, 21 Sep 2026 05:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_eus_long_life:8.4::appstream |
|
| References |
|
Mon, 21 Sep 2026 04:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Els
|
|
| CPEs | cpe:/o:redhat:rhel_els:7 | |
| Vendors & Products |
Redhat rhel Els
|
|
| References |
|
Thu, 17 Sep 2026 12:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat rhel Aus
Redhat rhel Eus Long Life |
|
| CPEs | cpe:/a:redhat:rhel_aus:8.6::appstream cpe:/a:redhat:rhel_eus_long_life:8.6::appstream |
|
| Vendors & Products |
Redhat rhel Aus
Redhat rhel Eus Long Life |
|
| References |
|
Thu, 17 Sep 2026 07:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat enterprise Linux Eus
Redhat rhel E4s Redhat rhel Eus Redhat rhel Tus |
|
| CPEs | cpe:/a:redhat:rhel_e4s:8.8::appstream cpe:/a:redhat:rhel_e4s:9.2::appstream cpe:/a:redhat:rhel_e4s:9.4::appstream cpe:/a:redhat:rhel_eus:9.6::appstream cpe:/a:redhat:rhel_eus:9.6::crb cpe:/a:redhat:rhel_tus:8.8::appstream cpe:/o:redhat:enterprise_linux_eus:10.0 |
|
| Vendors & Products |
Redhat enterprise Linux Eus
Redhat rhel E4s Redhat rhel Eus Redhat rhel Tus |
|
| References |
|
Fri, 21 Aug 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Fri, 21 Aug 2026 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat libvirt
|
|
| Vendors & Products |
Redhat libvirt
|
Thu, 20 Aug 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation. | |
| Title | Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow | |
| First Time appeared |
Redhat
Redhat enterprise Linux Redhat enterprise Linux Nvidia |
|
| Weaknesses | CWE-190 | |
| CPEs | cpe:/a:redhat:enterprise_linux_nvidia: cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9 |
|
| Vendors & Products |
Redhat
Redhat enterprise Linux Redhat enterprise Linux Nvidia |
|
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2026-08-20T09:54:50.958Z
Updated: 2026-10-05T08:29:44.646Z
Reserved: 2026-08-05T07:41:23.966Z
Link: CVE-2026-18917
Vulnrichment
Updated: 2026-08-20T15:36:03.808Z
NVD
Status : Awaiting Analysis
Published: 2026-08-20T10:16:40.507
Modified: 2026-10-27T10:10:00.240
Link: CVE-2026-18917
Redhat
No data.