Live › vulnerability › CVE-2026-120830
libslirp is the user-mode networking library used by QEMU and similar virtual machine tools. A malformed or truncated IPv4 packet can make its ICMP error builder read past a heap buffer and copy the extra host memory into the error reply sent back to a guest or container.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 00:47 UTC. All times on this page are UTC.
Systems that run guests or containers through libslirp user-mode networking, where a guest can send malformed IPv4 traffic that triggers an ICMP error reply. Hosts that do not use libslirp, or that use other network backends, are not described as exposed. The sources do not name affected versions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| libslirp | upstream | < 4.9.7 (first affected version not stated in sources) | 4.9.7 |
pkg-config --modversion slirp; versions below 4.9.7 (upstream) are not fixed unless your distro backported commit 21b33a6.-netdev user / -net user) or links libslirp (ldd $(which qemu-system-x86_64) | grep slirp). Also check any container/VM tool (e.g. rootless network stacks) that bundles libslirp.4.9.7 (released 2026-10-30) or later; upstream commit 21b33a6 clamps the quoted IP length to the source mbuf length in icmp_forward_error()Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.
This page as .md · .json · in your agent: get_signal("CVE-2026-120830")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.