CVE-2026-9539

EUVD-2026-38654
An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 12.97%
Debian logo
Debian Releases
Debian Product
Codename
libslirp
bookworm
postponed
bullseye
postponed
forky
4.9.4-1
fixed
sid
4.9.4-1
fixed
trixie
4.8.0-1+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libslirp
focal
needs-triage
jammy
Fixed 4.6.1-1ubuntu0.2
released
noble
Fixed 4.7.0-1ubuntu3.1
released
questing
ignored
resolute
Fixed 4.9.1-1ubuntu1.1
released
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
ivshmem-tools
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-audio-alsa
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-audio-oss
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-audio-pa
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-audio-sdl
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-block-curl
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-block-dmg
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-block-iscsi
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-block-nfs
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-block-rbd
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-block-ssh
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-common
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-debuginfo
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-guest-agent
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-img
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-kvm
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-kvm-core
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-system-aarch64
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-system-aarch64-core
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-system-x86
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-system-x86-core
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-ui-curses
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-ui-gtk
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-ui-sdl
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-user
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-user-binfmt
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
qemu-user-static
Amazon Linux 2
10:3.1.0-8.amzn2.0.26
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
libslirp
Azure Linux 3.0
0:4.9.3-1.azl3
fixed
Common Weakness Enumeration
References
https://gitlab.freedesktop.org/slirp/libslirp/-/commit/927bca7344e31fd58e2f7afaca784aad4400eb84
https://gitlab.freedesktop.org/slirp/libslirp/-/releases/v4.9.2
https://gitlab.freedesktop.org/slirp/libslirp/-/work_items/93
https://gitlab.freedesktop.org/slirp/libslirp/-/work_items/93