A local unprivileged user can trigger an integer overflow in libvirt's NodeGetFreePages RPC handler. This overflow allows crafted input to bypass a size check and allocate an undersized buffer on the heap. Real NUMA node data can then overwrite this buffer, corrupting the memory of the daemon that runs as root. The resulting heap corruption can cause a denial of service or enable the attacker to gain additional privileges on the system.

The vulnerability affects Red Hath Enterprise Linux 10, 6, 7, 8, 9, and the NVIDIA‑specific RHEL for NVIDIA 26 distribution through the libvirt service. All supported versions of the libvirt daemon in these distributions are potentially impacted.

The CVSS score of 7.8 indicates a high severity, and the EPSS score of less than 1% suggests that exploitation is currently unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local; an attacker must have a user account on the host and must be able to communicate with the libvirt RPC service. The flaw can be exploited by sending a specially crafted request to the libvirt daemon over the insecure read‑only Unix socket, leading to memory corruption without requiring elevated privileges.