An integer overflow vulnerability was found in libvirt's NodeGetFreePages RPC handler in src/remote/remote_daemon_dispatch.c. The dispatcher computes a 32-bit product (pages_len * cellCount) for both validation and memory allocation. While pages_len is XDR-capped at 1024, cellCount remains unbounded. The multiplication truncates modulo 2^32, allowing crafted values to bypass the guard check. The undersized buffer is then overwritten with real NUMA node data. The RPC call requires only connect:read ACL (lowest permission tier) and is accessible via the world-readable Unix socket (mode 0666) with no authentication for VIR_CONNECT_RO clients. An unprivileged local user could exploit this to corrupt the root libvirt daemon's heap, leading to denial of service or potentially local privilege escalation.