{"id":"CVE-2026-120830","title":"Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure","summary":"A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malfor…","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvssSource":"cna","cwe":["CWE-125"],"vendor":"Red Hat","product":"libslirp","affected":["libslirp (all versions)","container-tools:rhel8/libslirp (all versions)","libslirp (all versions)","libslirp (all versions)","openshift/ose-rhel-coreos-8 (all versions)","openshift/ose-rhel-coreos-9 (all versions)","openshift/ose-rhel-coreos-9 (all versions)"],"published":"2026-11-03","updated":"2026-11-04","sourceUpdated":"2026-11-04T22:06:47.499Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120830","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-120830"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2565424","label":"RHBZ#2565424"},{"url":"https://gitlab.freedesktop.org/slirp/libslirp/-/commit/21b33a6c5588af9f58d15e528fdc1019452708e4"}],"tags":["cve.org"],"epss":0.00221,"epssPercentile":0.12832,"ingestedAt":"2026-11-05T21:36:00.633Z","slug":"CVE-2026-120830","body":"## Overview\n\nA flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.\n\n## Affected\n\n- `libslirp (all versions)`\n- `container-tools:rhel8/libslirp (all versions)`\n- `libslirp (all versions)`\n- `libslirp (all versions)`\n- `openshift/ose-rhel-coreos-8 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n- `openshift/ose-rhel-coreos-9 (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nRed Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.\n\n--- CME Mitigation Guidance (2026-11-04) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\n\nThe highest-value action is to clamp quoted IPv4 payload length to actual buffer bounds in libslirp icmp_forward_error before copying data into ICMP error responses: upgrade to the corresponding fixed Red Hat builds, which clamp s_ip_len to the source buffer length msrc->m_len before copying payload data into the ICMP error packet, closing crafted truncated IPv4 packets with ip_len exceeding mbuf length. Until patched, this is a concern on guests or containers transmitting network traffic through libslirp, so restrict untrusted guests or containers from transmitting network traffic across libslirp virtual network interfaces. These controls limit blast radius and contain exploitation, but they do not fix the underlying out-of-bounds heap read defect — apply the upstream patch to fully remediate.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}