PT-2026-51663 · Freedesktop.Org · Libslirp

Bruce Chen + 1 · Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-9539

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP NET RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti urp).

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-9539

Affected Products

Libslirp

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-9539 · Security Note
• https://gitlab.freedesktop.org/slirp/libslirp/-/commit/927bca7344e31fd58e2f7afaca784aad4400eb84 · Patch
• https://gitlab.freedesktop.org/slirp/libslirp/-/work_items/93 · Note
• https://gitlab.freedesktop.org/slirp/libslirp/-/releases/v4.9.2 · Note