CVE-2026-95508
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.
Risk Assessment
An attacker from the guest could cause denial of service or execute arbitrary code in the host process, potentially leading to host compromise.
Recommendation
Update libslirp to a patched version or avoid configurations with a small interface MTU.
Other vulnerabilities in libslirp
Original NVD description (English source)
A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS