libslirp CVE-2026-120831

The host must use libslirp user-mode networking (the slirp/slirp4netns backend, as in QEMU user networking or rootless Podman/OpenShift container networking) rather than bridge/tap/passt. Exploitation requires the attacker to already control a guest attached to that virtual network (AV:A), from which burst traffic drives the fast-queue-to-batch-queue session move in if_output() that corrupts the queue pointers. No host authentication or user interaction is needed (PR:N/UI:N). Limiting factors: the attacker must occupy a guest on the libslirp network, the slirp backend must actually be in use, and the impact is confined to availability - the host networking process crashes (DoS) with no confidentiality or integrity loss and no demonstrated code execution.

This is a medium-severity, availability-only issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 6.5) tells a consistent story: the attacker operates from the adjacent virtual network (a guest), needs no host privileges and no user interaction, and the only impact is loss of host networking availability (C:N/I:N/A:H). Although the tags say 'Buffer Overflow' and 'Memory Corruption' and the CWE is CWE-787 (out-of-bounds write), the description explicitly limits the outcome to a crash of the host networking process (denial of service) - it does not claim code execution, and the C:N/I:N metrics agree, so this should NOT be treated as RCE. No EPSS score, KEV listing, or public exploit was supplied; the only exploit-relevant reference is the upstream fix commit, not proof-of-concept exploit code. The vuln.today decision label is 'this_month', signalling a routine patch cycle rather than act_now/emergency. Net: a legitimate reliability/DoS risk for multi-tenant virtualization and rootless-container hosts using the slirp backend, but not a high-urgency exploitation threat. Note the signals are not conflicting - CVSS, description and decision label all point to a moderate DoS.

An attacker who controls a guest VM or rootless container whose host uses libslirp user-mode networking sends a burst of traffic that forces a session to be moved from the fast queue to the batch queue. The flawed if_output() unlinks and reinserts the wrong packet via ifm->m_nextpkt, corrupting the queue pointers and crashing the host networking process, which severs connectivity for co-hosted guests. No public exploit code was provided in the input; only the upstream fix commit is referenced.