Out-of-Bounds Heap Read in Libslirp Affecting Networking Functionality
CVE-2026-120830
7.4HIGH
What is CVE-2026-120830?
A vulnerability exists in libslirp related to the handling of ICMP error responses. When generating these responses, the length of the original IPv4 packet is improperly determined from the IP header without ensuring it is within the bounds of the actual memory buffer. As a result, this could lead to a situation where a truncated or malformed packet causes an out-of-bounds read from the heap, leading to potential leakage of sensitive host memory into the returned ICMP error packet, which poses a risk to guests or containers using this networking stack.
References
CVSS V3.1
Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Red Hat would like to thank Piyusha Akash (Manifold Operations) for reporting this issue.