libslirp CVE-2026-9539

Exploitation requires the attacker to hold root or CAP_NET_RAW privileges inside a guest VM running on a host that uses libslirp before v4.9.2 for user-space network emulation (e.g., QEMU with the default user-mode networking backend). The attacker must be able to send raw TCP segments with manipulated URG flags and urgent pointer (ti_urp) values from within the guest network stack toward the libslirp-emulated interface on the host. Exploitation is blocked when: the guest VM operates without root or CAP_NET_RAW (e.g., unprivileged containers or VMs running as a non-root user without the capability granted); the hypervisor uses a kernel-backed network backend (TAP/TUN, virtio-net) rather than libslirp; or libslirp v4.9.2 or later is in use. The attack does not cross network boundaries to remote hosts - it is entirely contained within the guest-to-host user-space networking path.

The CVSS 3.1 base score of 6.5 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) is technically sound but operationally understates the cross-boundary impact in multi-tenant environments: S:C signals the exploit crosses the guest-to-host boundary, and C:H confirms the full confidentiality impact on host process memory. AC:L means no special race conditions or environment factors are needed beyond sending crafted TCP segments - the trigger is deterministic. PR:L reflects the requirement for root or CAP_NET_RAW inside the guest, which is a realistic baseline in many cloud or lab VM workloads. No EPSS score was provided in the input data, so exploitation probability cannot be quantified numerically. The vulnerability is not listed in CISA KEV and no public exploit or proof-of-concept was identified at time of analysis. Despite the moderate numeric score, teams operating QEMU-based multi-tenant infrastructure where guests hold root should treat this as elevated priority: the attacker has no integrity or availability impact, but the ability to exfiltrate gigabytes of host heap across a VM boundary is a high-value reconnaissance capability for staged attacks or co-tenant data theft.

An attacker who controls a guest VM with root or CAP_NET_RAW privileges writes a tool that repeatedly sends TCP segments with crafted URG flags and computed ti_urp values designed to underflow the urgent pointer arithmetic in libslirp's sosendoob() on the host. Each crafted segment causes the host process to read beyond the intended heap buffer boundary, and the returned data - accumulated over many requests - leaks gigabytes of host memory potentially containing co-tenant VM data, TLS session keys, or credentials held in the hypervisor process. No public exploit code has been identified at time of analysis, but the attack requires only standard raw socket capabilities available to guest root and the trigger mechanism (URG flag manipulation) is well-understood.