An injection vulnerability in libvirt's network XML parser allows newline characters to be inserted into DNS TXT and SRV record values, which are then written verbatim into dnsmasq’s configuration file, enabling an attacker who can define or modify virtual networks to inject arbitrary dnsmasq directives such as dhcp-script and obtain root command execution. This flaw corresponds to CWE‑93 and permits arbitrary command execution when the attacker has permission to create or alter virtual network definitions.

The vulnerability affects Red Hat Enterprise Linux releases 6, 7, 8, 9, 10 and Red Hat Enterprise Linux for NVIDIA 26; it resides in libvirt’s virtual network driver and is present in all versions of these distributions that include libvirt.

The CVSS base score is 2.3, indicating low severity, and EPSS is not available; the flaw is not listed in CISA KEV. The attack requires the ability to edit virtual network definitions, which is typically restricted to privileged users, so the risk is moderate for environments where non‑privileged users can create or alter network configurations. No official workaround exists, and a patch is not yet available, so mitigation relies on restricting network definition rights and monitoring for unauthorized dnsmasq configuration changes until an updated libvirt release is deployed.