Skip to main content

libslirp CVE-2026-9539

| EUVDEUVD-2026-38654 MEDIUM
Out-of-bounds Read (CWE-125)
2026-06-24 STAR_Labs GHSA-4243-hp56-4m7f
Buffer Overflow Information Disclosure Suse Libslirp
6.5
CVSS 3.1 · Vendor: STAR_Labs
Share

Severity by source

Vendor (STAR_Labs) PRIMARY
6.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
vuln.today AI
6.5 MEDIUM

AV:L because exploit originates inside guest VM; S:C for cross-VM-to-host boundary; PR:L for required guest root/CAP_NET_RAW; C:H for heap leak; I:N and A:N as impact is read-only.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (STAR_Labs).

CVSS VectorVendor: STAR_Labs

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
Analysis Generated
Jun 24, 2026 - 05:34 vuln.today

DescriptionCVE.org

An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).

AnalysisAI

Out-of-bounds heap read and integer underflow in libslirp's TCP urgent data handler (sosendoob) exposes gigabytes of host process heap memory to a privileged guest VM attacker. All libslirp releases before v4.9.2, as embedded in hypervisors such as QEMU, are affected when guest workloads hold root or CAP_NET_RAW privileges. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the cross-VM-boundary scope change (S:C) and high confidentiality impact make this a material risk in multi-tenant or shared virtualization environments.

Technical ContextAI

libslirp is a user-space TCP/IP stack library (CPE: cpe:2.3:a:freedesktop.org:libslirp:*:*:*:*:*:*:*:*) embedded in hypervisors such as QEMU to provide network emulation for guest VMs without kernel-level host networking privileges. The vulnerable function, sosendoob(), processes TCP urgent (out-of-band) data signaled by the URG flag and the urgent pointer field (ti_urp) in TCP segment headers. An integer underflow in the urgent pointer arithmetic causes CWE-125 (out-of-bounds read) on the host-side heap buffer managed by libslirp. Because libslirp executes entirely within the hypervisor host process's address space, a successful heap over-read leaks host memory that may contain encryption keys, credentials, inter-VM data, or other sensitive runtime state. The attack surface is the user-space TCP stack parsing path, not the host kernel - patched in commit 927bca7344e31fd58e2f7afaca784aad4400eb84 and released as v4.9.2.

RemediationAI

The primary remediation is to upgrade libslirp to v4.9.2 or later, available at https://gitlab.freedesktop.org/slirp/libslirp/-/releases/v4.9.2; the specific fix is tracked in commit 927bca7344e31fd58e2f7afaca784aad4400eb84 at https://gitlab.freedesktop.org/slirp/libslirp/-/commit/927bca7344e31fd58e2f7afaca784aad4400eb84. Organizations running QEMU or other hypervisors that vendor-bundle libslirp should verify their distribution has incorporated v4.9.2 or the patch commit, as downstream package updates may lag upstream. Where immediate patching is not possible, restricting guest VM workloads from obtaining root or CAP_NET_RAW inside the VM eliminates the exploitation path, though this may break legitimate use cases requiring raw socket access (e.g., network testing tools, custom VPN clients inside guests). Switching the hypervisor network backend from libslirp/user-mode networking to a kernel-backed mechanism (e.g., TAP/TUN with virtio-net) also mitigates the vulnerability but requires host network configuration changes and may introduce additional privilege requirements on the host side.

More in Libslirp

View all
CVE-2020-1983 MEDIUM POC
6.5 Apr 22

A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets t
CVE-2019-14378 HIGH POC
8.8 Jul 29

ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mishandles a cas
CVE-2020-29130 MEDIUM POC
4.3 Nov 26

slirp.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even i
CVE-2020-7211 HIGH
7.5 Jan 21

tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\ directory traversal on Windows. Rated high severit
CVE-2019-15890 HIGH
7.5 Sep 06

libslirp 4.0.0, as used in QEMU 4.1.0, has a use-after-free in ip_reass in ip_input.c. Rated high severity (CVSS 7.5), t
CVE-2020-10756 MEDIUM
6.5 Jul 09

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. Rated medium

CVE-2020-8608 MEDIUM
5.6 Feb 06

In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in lat
CVE-2020-7039 MEDIUM
5.6 Jan 16

tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands i
CVE-2020-29129 MEDIUM
4.3 Nov 26

ncsi.c in libslirp through 4.3.1 has a buffer over-read because it tries to read a certain amount of header data even if
CVE-2021-3595 LOW
3.8 Jun 15

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. Rated low severity (CV
CVE-2021-3594 LOW
3.8 Jun 15

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. Rated low severity (CV
CVE-2021-3593 LOW
3.8 Jun 15

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. Rated low severity (CV

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected

Share

CVE-2026-9539 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy