This vulnerability arises from improper neutralization of CRLF sequences in libvirt's virtual network driver. Specifically, newline characters in DNS TXT record value attributes and SRV record domain/target attributes are not stripped by the network XML parser. These unfiltered values are written directly into the dnsmasq configuration file generated by the network driver. An attacker with permission to define virtual networks can inject arbitrary dnsmasq configuration directives such as dhcp-script, potentially leading to arbitrary command execution as root. The vulnerability is tracked as CVE-2026-61477 and affects Red Hat Enterprise Linux 10. The CVSS v3.1 score assigned by Red Hat is 2.3 (low severity), reflecting local attack vector, low attack complexity, and requirement for high privileges. No vendor advisory indicates an official patch or remediation at this time.

The vulnerability allows a local user with permission to define virtual networks to inject arbitrary configuration directives into the dnsmasq configuration file, which can lead to arbitrary command execution as root. However, exploitation requires high privileges and local access. The impact is limited to integrity compromise with no confidentiality or availability impact reported. The overall severity is low according to Red Hat's CVSS assessment.

As per the Red Hat advisory, no mitigation or fix meeting Red Hat's criteria for ease of use, deployment, applicability, or stability is currently available. Users should monitor the Red Hat advisory for updates. Customers with a Red Hat Technical Account Manager (TAM) can discuss this CVE directly with their TAM for potential guidance. Until an official fix is released, restricting permissions to define virtual networks to trusted users is advisable.