CVE-2026-61477 is an injection vulnerability in libvirt's virtual network driver. The network XML parser fails to sanitize newline characters in DNS TXT record value attributes and SRV record domain/target attributes. These unsanitized values are written directly into the dnsmasq configuration file generated by the network driver. This flaw allows a user with permission to define virtual networks to inject arbitrary dnsmasq configuration directives such as dhcp-script, which can lead to arbitrary command execution with root privileges. The vulnerability is classified under CWE-93 (Improper Neutralization of CRLF Sequences). The CVSS v3.1 base score is 2.3, reflecting low severity due to required local access with high privileges and no confidentiality or availability impact. Red Hat has not provided an official fix or mitigation that meets their criteria for ease of use, applicability, or stability.

A user with permission to define virtual networks can inject arbitrary dnsmasq configuration directives, potentially leading to arbitrary command execution as root. The vulnerability requires local access with high privileges and does not impact confidentiality or availability. The overall impact is low severity.

Currently, no official fix or mitigation is available that meets Red Hat's criteria for deployment and stability. Users should monitor Red Hat advisories for updates. Until a fix is released, restricting permissions to define virtual networks to trusted users is advisable to reduce risk.