Skip to content

CVE-2026-9539

libslirp TCP URG OOB Read Information Leak

6.5 MediumPublic exploitFix available

An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.22%Up 0.1 points since Jun 24, 2026

What each source reports

CVE List Score used 6.5

libslirp TCP URG OOB Read Information Leak

An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).

Record: CVE-2026-9539
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-125
Updated: 2026-11-02

EUVDEUVD-2026-38654 6.5

An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).

Record: EUVD-2026-38654
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4243-hp56-4m7f 6.5

An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in...

An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).

Record: GHSA-4243-hp56-4m7f
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-125
Updated: 2026-11-02

NVD 6.5

An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).

Record: CVE-2026-9539
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-125
Updated: 2026-11-02

OSVBELL-CVE-2026-9539 6.5

Record: BELL-CVE-2026-9539
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSV 6.5

libslirp TCP URG OOB Read Information Leak

An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).

Record: CVE-2026-9539
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness: CWE-125
Updated: 2026-11-02

Show 11 moreShow less

OSVDEBIAN-CVE-2026-9539 6.5

An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).

Record: DEBIAN-CVE-2026-9539
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-9539 6.5

An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).

Record: UBUNTU-CVE-2026-9539
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated: 2026-11-02

OSVAZL-90912 No score

CVE-2026-9539 affecting package libslirp for versions less than 4.9.3-1

An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).

Record: AZL-90912
Updated: 2026-11-02

OSVMGASA-2026-0306 No score

Updated libslirp packages fix a security vulnerability

The updated packages fix a security vulnerability: TCP URG OOB Read Information Leak. (CVE-2026-9539)

Record: MGASA-2026-0306
Updated: 2026-11-02

OSVopenSUSE-SU-2026:11134-1 No score

libslirp-devel-4.9.3+4-1.1 on GA media

These are all security issues fixed in the libslirp-devel-4.9.3+4-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:11134-1
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21216-1 No score

Security update for libslirp

This update for libslirp fixes the following issue

CVE-2026-9539: TCP URG out of bounds heap read information leak (bsc#1268903).

Record: openSUSE-SU-2026:21216-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22452-1 No score

Security update for libslirp

This update for libslirp fixes the following issue

CVE-2026-9539: TCP URG out of bounds heap read information leak (bsc#1268903).

Record: SUSE-SU-2026:22452-1
Updated: 2026-11-02

OSVSUSE-SU-2026:22514-1 No score

Security update for libslirp

This update for libslirp fixes the following issue

CVE-2026-9539: TCP URG out of bounds heap read information leak (bsc#1268903).

Record: SUSE-SU-2026:22514-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2886-1 No score

Security update for libslirp

This update for libslirp fixes the following issues:

CVE-2026-9539: TCP URG out of bounds heap read information leak (bsc#1268903).

Record: SUSE-SU-2026:2886-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2931-1 No score

Security update for libslirp

This update for libslirp fixes the following issues:

CVE-2026-9539: TCP URG out of bounds heap read information leak (bsc#1268903).

Record: SUSE-SU-2026:2931-1
Updated: 2026-11-02

OSVUSN-8550-1 No score

libslirp vulnerability

It was discovered that libslirp incorrectly handled TCP urgent data. A privileged attacker inside a guest VM could possibly use this issue to obtain sensitive information from the host process memory.

Record: USN-8550-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libslirp` Azure Linux:3	before 4.9.3-1	4.9.3-1
`libslirp` Alpaquita:23	4.7.0-r0 up to 4.7.0-r1	4.7.0-r1
`libslirp` Alpaquita:25	4.8.0-r0 up to 4.8.0-r1	4.8.0-r1
`libslirp` Alpaquita:stream	4.7.0-r0 up to 4.9.3-r0	4.9.3-r0
`libslirp` Debian:12	All versions, plus listed versions 4.7.0-14.8.0-14.9.1-14.9.2-14.9.3-14.9.4-14.9.5-1	None known
`libslirp` Debian:13	before 4.8.0-1+deb13u1, plus listed versions 4.8.0-1	4.8.0-1+deb13u1
`libslirp` Debian:14	before 4.9.2-1, plus listed versions 4.8.0-14.9.1-1	4.9.2-1
`libslirp` Mageia:10	before 4.8.0-2.1.mga10	4.8.0-2.1.mga10
`libslirp` Mageia:9	before 4.6.1-1.1.mga9	4.6.1-1.1.mga9
`libslirp` SUSE:Linux Micro 6.1	before 4.8.0+2-slfo.1.1_2.1	4.8.0+2-slfo.1.1_2.1

Show 12 moreShow less

Affected packages
Package	Affected	Fixed
`libslirp` SUSE:Linux Micro 6.0	before 4.7.0+44-5.1	4.7.0+44-5.1
`libslirp` SUSE:Linux Enterprise Micro 5.3	before 4.7.0+44-150300.18.1	4.7.0+44-150300.18.1
`libslirp` SUSE:Linux Enterprise Micro 5.4	before 4.7.0+44-150300.18.1	4.7.0+44-150300.18.1
`libslirp` SUSE:Linux Enterprise Micro 5.5	before 4.7.0+44-150500.4.3.1	4.7.0+44-150500.4.3.1
`libslirp` SUSE:Linux Enterprise Module for Basesystem 15 SP7	before 4.7.0+44-150500.4.3.1	4.7.0+44-150500.4.3.1
`libslirp` Ubuntu:20.04:LTS	All versions, plus listed versions 4.0.0-14.0.0-24.1.0-14.1.0-24.1.0-2ubuntu14.1.0-2ubuntu24.1.0-2ubuntu2.14.1.0-2ubuntu2.2	None known
`libslirp` Ubuntu:22.04:LTS	before 4.6.1-1ubuntu0.2, plus listed versions 4.4.0-1build14.6.1-14.6.1-1build1	4.6.1-1ubuntu0.2
`libslirp` Ubuntu:24.04:LTS	before 4.7.0-1ubuntu3.1, plus listed versions 4.7.0-1ubuntu14.7.0-1ubuntu24.7.0-1ubuntu3	4.7.0-1ubuntu3.1
`libslirp` Ubuntu:25.10	All versions, plus listed versions 4.8.0-1ubuntu1	None known
`libslirp` Ubuntu:26.04:LTS	before 4.9.1-1ubuntu1.1, plus listed versions 4.8.0-1ubuntu14.9.1-1ubuntu1	4.9.1-1ubuntu1.1
`libslirp` openSUSE:Tumbleweed	before 4.9.3+4-1.1	4.9.3+4-1.1
`libslirp` openSUSE:Leap 16.0	before 4.8.0+2-160000.3.1	4.8.0+2-160000.3.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	quarkslab/slirp_snapshots_stateful	2026-10-19

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-9539 is a medium vulnerability (CVSS 6.5) in Freedesktop.org Libslirp, published June 24, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in libslirp 4.9.3-1.

References

Show 15 moreShow less