CVE-2026-95507

Medium

Published: —Translated: 24/09/2026(UTC)NVD NIST

Summary

An out-of-bounds read was found in the NC-SI OEM response handler of libslirp. A truncated NC-SI OEM Ethernet frame causes ncsi_rsp_handler_oem() to read up to 4 bytes beyond the supplied packet length and reflect the value into the response sent to the guest, resulting in guest-observable disclosure.

Risk Assessment

A guest can read up to 4 bytes of host process memory, potentially leaking sensitive information from the virtual machine or emulation process memory.

Recommendation

Update libslirp to a version containing the fix for this bug, or restrict the guest's ability to send NC-SI OEM frames if updating is not possible.

Other vulnerabilities in libslirp

CVE-2026-95508High
A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS