<security-notice xmlns="http://security.libvirt.org/xmlns/security-notice/1.0">
  <id>2026-0002</id>

  <summary>integer overflow in RPC handler for virNodeGetFreePages</summary>

  <description>
<![CDATA[The RPC handler 'remoteDispatchNodeGetFreePages' multiplies the
         'npages' argument with the 'cellcount' argument passed to
         'virNodeGetFreePages', both of which are declared as 'unsigned int' to
         both do an RPC limit check against the 'REMOTE_NODE_MAX_CELLS' constant
         and then to allocate the memory to hold the result from the actual
         hypervisor driver.

         Since both the values are 'unsigned int' the product is also unsigned
         int so big enough numbers can overflow, both passing the check and also
         allocating not enough memory for the result. The hypervisor driver
         assumes that the passed buffer is large enough and overwrites memory.

         When this happens the the hypervisor daemon crashes.

         This can be triggered e.g. by passing 1023 and 4198405 as values which
         multiply to 1019 after wrapping to 32 bit unsigned value.]]>
  </description>

  <impact>
<![CDATA[Unprivileged users can cause the libvirt daemon to crash by writing
         beyond the end of the buffer]]>
  </impact>

  <workaround>
<![CDATA[None]]>
  </workaround>

  <credits>
    <reporter>
      <name>Ada Logics</name>
      <email></email>
    </reporter>
    <reporter>
      <name>Anthropic Research</name>
      <email></email>
    </reporter>
    <patcher>
      <name>Peter Krempa</name>
      <email>pkrempa@redhat.com</email>
    </patcher>
  </credits>

  <lifecycle>
    <reported>20260804</reported>
    <published>20260812</published>
    <fixed>20260812</fixed>
  </lifecycle>

  <reference>
    <advisory type="CVE" id="2026-18917"/>
  </reference>

  <product name="libvirt">
    <repository>libvirt.git</repository>
    <branch>
      <name>master</name>
      <tag state="vulnerable">v1.2.6</tag>
      <tag state="vulnerable">v1.2.7</tag>
      <tag state="vulnerable">v1.2.8</tag>
      <tag state="vulnerable">v1.2.9</tag>
      <tag state="vulnerable">v1.2.10</tag>
      <tag state="vulnerable">v1.2.11</tag>
      <tag state="vulnerable">v1.2.12</tag>
      <tag state="vulnerable">v1.2.13</tag>
      <tag state="vulnerable">v1.2.14</tag>
      <tag state="vulnerable">v1.2.15</tag>
      <tag state="vulnerable">v1.2.16</tag>
      <tag state="vulnerable">v1.2.17</tag>
      <tag state="vulnerable">v1.2.18</tag>
      <tag state="vulnerable">v1.2.19</tag>
      <tag state="vulnerable">v1.2.20</tag>
      <tag state="vulnerable">v1.2.21</tag>
      <tag state="vulnerable">v1.3.0</tag>
      <tag state="vulnerable">v1.3.1</tag>
      <tag state="vulnerable">v1.3.2</tag>
      <tag state="vulnerable">v1.3.3</tag>
      <tag state="vulnerable">v1.3.4</tag>
      <tag state="vulnerable">v1.3.5</tag>
      <tag state="vulnerable">v2.0.0</tag>
      <tag state="vulnerable">v2.1.0</tag>
      <tag state="vulnerable">v2.2.0</tag>
      <tag state="vulnerable">v2.3.0</tag>
      <tag state="vulnerable">v2.4.0</tag>
      <tag state="vulnerable">v2.5.0</tag>
      <tag state="vulnerable">v3.0.0</tag>
      <tag state="vulnerable">v3.1.0</tag>
      <tag state="vulnerable">v3.2.0</tag>
      <tag state="vulnerable">v3.3.0</tag>
      <tag state="vulnerable">v3.4.0</tag>
      <tag state="vulnerable">v3.5.0</tag>
      <tag state="vulnerable">v3.6.0</tag>
      <tag state="vulnerable">v3.7.0</tag>
      <tag state="vulnerable">v3.8.0</tag>
      <tag state="vulnerable">v3.9.0</tag>
      <tag state="vulnerable">v3.10.0</tag>
      <tag state="vulnerable">v4.0.0</tag>
      <tag state="vulnerable">v4.1.0</tag>
      <tag state="vulnerable">v4.2.0</tag>
      <tag state="vulnerable">v4.3.0</tag>
      <tag state="vulnerable">v4.4.0</tag>
      <tag state="vulnerable">v4.5.0</tag>
      <tag state="vulnerable">v4.6.0</tag>
      <tag state="vulnerable">v4.7.0</tag>
      <tag state="vulnerable">v4.8.0</tag>
      <tag state="vulnerable">v4.9.0</tag>
      <tag state="vulnerable">v4.10.0</tag>
      <tag state="vulnerable">v5.0.0</tag>
      <tag state="vulnerable">v5.1.0</tag>
      <tag state="vulnerable">v5.2.0</tag>
      <tag state="vulnerable">v5.3.0</tag>
      <tag state="vulnerable">v5.4.0</tag>
      <tag state="vulnerable">v5.5.0</tag>
      <tag state="vulnerable">v5.6.0</tag>
      <tag state="vulnerable">v5.7.0</tag>
      <tag state="vulnerable">v5.8.0</tag>
      <tag state="vulnerable">v5.9.0</tag>
      <tag state="vulnerable">v5.10.0</tag>
      <tag state="vulnerable">v6.0.0</tag>
      <tag state="vulnerable">v6.1.0</tag>
      <tag state="vulnerable">v6.2.0</tag>
      <tag state="vulnerable">v6.3.0</tag>
      <tag state="vulnerable">v6.4.0</tag>
      <tag state="vulnerable">v6.5.0</tag>
      <tag state="vulnerable">v6.6.0</tag>
      <tag state="vulnerable">v6.7.0</tag>
      <tag state="vulnerable">v6.8.0</tag>
      <tag state="vulnerable">v6.9.0</tag>
      <tag state="vulnerable">v6.10.0</tag>
      <tag state="vulnerable">v7.0.0</tag>
      <tag state="vulnerable">v7.1.0</tag>
      <tag state="vulnerable">v7.2.0</tag>
      <tag state="vulnerable">v7.3.0</tag>
      <tag state="vulnerable">v7.4.0</tag>
      <tag state="vulnerable">v7.5.0</tag>
      <tag state="vulnerable">v7.6.0</tag>
      <tag state="vulnerable">v7.7.0</tag>
      <tag state="vulnerable">v7.8.0</tag>
      <tag state="vulnerable">v7.9.0</tag>
      <tag state="vulnerable">v7.10.0</tag>
      <tag state="vulnerable">v8.0.0</tag>
      <tag state="vulnerable">v8.1.0</tag>
      <tag state="vulnerable">v8.2.0</tag>
      <tag state="vulnerable">v8.3.0</tag>
      <tag state="vulnerable">v8.4.0</tag>
      <tag state="vulnerable">v8.5.0</tag>
      <tag state="vulnerable">v8.6.0</tag>
      <tag state="vulnerable">v8.7.0</tag>
      <tag state="vulnerable">v8.8.0</tag>
      <tag state="vulnerable">v8.9.0</tag>
      <tag state="vulnerable">v8.10.0</tag>
      <tag state="vulnerable">v9.0.0</tag>
      <tag state="vulnerable">v9.1.0</tag>
      <tag state="vulnerable">v9.2.0</tag>
      <tag state="vulnerable">v9.3.0</tag>
      <tag state="vulnerable">v9.4.0</tag>
      <tag state="vulnerable">v9.5.0</tag>
      <tag state="vulnerable">v9.6.0</tag>
      <tag state="vulnerable">v9.7.0</tag>
      <tag state="vulnerable">v9.8.0</tag>
      <tag state="vulnerable">v9.9.0</tag>
      <tag state="vulnerable">v9.10.0</tag>
      <tag state="vulnerable">v10.0.0</tag>
      <tag state="vulnerable">v10.1.0</tag>
      <tag state="vulnerable">v10.2.0</tag>
      <tag state="vulnerable">v10.3.0</tag>
      <tag state="vulnerable">v10.4.0</tag>
      <tag state="vulnerable">v10.5.0</tag>
      <tag state="vulnerable">v10.6.0</tag>
      <tag state="vulnerable">v10.7.0</tag>
      <tag state="vulnerable">v10.8.0</tag>
      <tag state="vulnerable">v10.9.0</tag>
      <tag state="vulnerable">v10.10.0</tag>
      <tag state="vulnerable">v11.0.0</tag>
      <tag state="vulnerable">v11.1.0</tag>
      <tag state="vulnerable">v11.2.0</tag>
      <tag state="vulnerable">v11.3.0</tag>
      <tag state="vulnerable">v11.4.0</tag>
      <tag state="vulnerable">v11.5.0</tag>
      <tag state="vulnerable">v11.6.0</tag>
      <tag state="vulnerable">v11.7.0</tag>
      <tag state="vulnerable">v11.8.0</tag>
      <tag state="vulnerable">v11.9.0</tag>
      <tag state="vulnerable">v11.10.0</tag>
      <tag state="vulnerable">v12.0.0</tag>
      <tag state="vulnerable">v12.1.0</tag>
      <tag state="vulnerable">v12.2.0</tag>
      <tag state="vulnerable">v12.3.0</tag>
      <tag state="vulnerable">v12.4.0</tag>
      <tag state="vulnerable">v12.5.0</tag>
      <tag state="vulnerable">v12.6.0</tag>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
      <tag state="fixed">v12.7.0</tag>
      <change state="fixed">5a62cbf2907d4590283597b46da9c0f41e7b4d4f</change>
    </branch>
    <branch>
      <name>v1.2.6-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.2.7-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.2.8-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.2.9-maint</name>
      <tag state="vulnerable">v1.2.9.1</tag>
      <tag state="vulnerable">v1.2.9.2</tag>
      <tag state="vulnerable">v1.2.9.3</tag>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.2.10-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.2.11-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.2.12-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.2.13-maint</name>
      <tag state="vulnerable">v1.2.13.1</tag>
      <tag state="vulnerable">v1.2.13.2</tag>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.2.14-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.2.15-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.2.16-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.2.17-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.2.18-maint</name>
      <tag state="vulnerable">v1.2.18.1</tag>
      <tag state="vulnerable">v1.2.18.2</tag>
      <tag state="vulnerable">v1.2.18.3</tag>
      <tag state="vulnerable">v1.2.18.4</tag>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.2.19-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.2.20-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.2.21-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.3.0-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.3.1-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.3.2-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.3.3-maint</name>
      <tag state="vulnerable">v1.3.3.1</tag>
      <tag state="vulnerable">v1.3.3.2</tag>
      <tag state="vulnerable">v1.3.3.3</tag>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.3.4-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v1.3.5-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v2.0-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v2.1-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v2.2-maint</name>
      <tag state="vulnerable">v2.2.1</tag>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v3.0-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v3.2-maint</name>
      <tag state="vulnerable">v3.2.1</tag>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v3.7-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v4.1-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v4.2-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v4.3-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v4.4-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v4.5-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v4.6-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v4.7-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v4.8-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v4.9-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v4.10-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v5.0-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v5.1-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v5.1.0-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v5.2-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
    <branch>
      <name>v5.3-maint</name>
      <change state="vulnerable">34f2d0319d2098c77c8cc27d8350616029125a2b</change>
    </branch>
  </product>

</security-notice>
