CVE-2026-18917 is an integer overflow vulnerability in libvirt's NodeGetFreePages RPC handler. Crafted input values can bypass size checks, leading to an undersized memory buffer and subsequent heap buffer overflow when real NUMA node data overwrites this buffer. This memory corruption affects the root libvirt daemon, potentially causing denial of service or local privilege escalation. The flaw requires local, low-privilege user access and does not require user interaction. The vulnerability is rated high severity with a CVSS 3.1 score of 7.8. The vendor advisory from Red Hat recommends restricting access to the vulnerable RPC handler via Unix socket permissions or enabling polkit authentication. No patch availability is explicitly stated in the advisory.

The vulnerability allows an unprivileged local user to cause heap buffer overflow in the root libvirt daemon's memory. This can lead to denial of service by crashing or destabilizing the daemon or local privilege escalation by corrupting memory to execute unauthorized code or commands. The CVSS vector indicates high impact on confidentiality, integrity, and availability. The flaw can bypass protection mechanisms and cause significant system instability or compromise.

Red Hat advises restricting access to the libvirt read-only Unix socket by setting 'unix_sock_ro_perms' to '0770' or '0700' and configuring 'unix_sock_group' to include only trusted users. Alternatively, enable polkit authentication for the read-only socket by setting 'auth_unix_ro = "polkit"', requiring authorization before RPC dispatch. After configuration changes, restart the libvirtd service. Note that restricting socket access may prevent unprivileged monitoring or read-only management tools from connecting. No official patch is confirmed in the advisory; therefore, these mitigations are currently recommended.