CVE-2026-120831Medium· 6.5▾ SunlitA flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointe…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service.
libslirp (all versions)container-tools:rhel8/libslirp (all versions)libslirp (all versions)libslirp (all versions)openshift/ose-rhel-coreos-8 (all versions)openshift/ose-rhel-coreos-9 (all versions)openshift/ose-rhel-coreos-9 (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-95508High· 7.4A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp
CVE-2026-120830High· 7.4Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure
CVE-2026-119777High· 8.8Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser
CVE-2026-114690Medium· 6.2Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std
CVE-2026-115455Medium· 6.5Gcc: stack overflow in std::bitset on libstdc++
CVE-2026-93011Medium· 5.3Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms