Heap Out-of-Bounds Read in libslirp ICMP Error Handling

Executive Summary

CVE-2026-120830 is a flaw in libslirp's icmp_forward_error() function where the length of a quoted IPv4 packet is taken from the IP header without checking if it fits within the actual buffer. This can cause an out-of-bounds heap read, leaking host memory into ICMP error packets sent to guests or containers.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of libslirp. Use commands like 'rpm -q libslirp' on Red Hat-based systems or 'dpkg -l libslirp' on Debian-based systems to identify installed versions. Compare the output against the patched version specified by your vendor.

Useful 0 Not Useful 0

Impact Analysis

An attacker in a guest or container could exploit this to read sensitive host memory contents via ICMP error packets. This may expose confidential data, though it does not allow modification or denial of service.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations must address it to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Apply security updates from your Linux distribution vendor immediately. If no patch is available, consider disabling services using libslirp or isolating affected guests/containers. Monitor vendor advisories for updates as Red Hat notes no practical temporary workaround exists.

Useful 0 Not Useful 0