CVE-2026-61477 is an injection vulnerability in libvirt's virtual network driver. The network XML parser fails to strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These unsanitized values are written directly into the dnsmasq configuration file generated by the network driver. This allows a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, which can lead to arbitrary command execution with root privileges. The vulnerability is classified under CWE-93 (Improper Neutralization of CRLF Sequences).

The vulnerability allows an attacker with permission to define virtual networks to inject arbitrary configuration directives into dnsmasq, potentially resulting in arbitrary command execution as root. The CVSS v3.1 base score is 2.3 (medium severity), reflecting local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and low integrity impact.

A patch is available for this vulnerability. Users are advised to upgrade to fixed versions of libvirt as indicated by their vendor or distribution. No effective mitigation other than patching is currently available or meets Red Hat's criteria for ease of use and applicability. Users should apply the official fixes when they become available to prevent exploitation.