{"id":"CVE-2026-9539","aliases":["AZL-90912","BELL-CVE-2026-9539","DEBIAN-CVE-2026-9539","EUVD-2026-38654","GHSA-4243-hp56-4m7f","MGASA-2026-0306","SUSE-SU-2026:22452-1","SUSE-SU-2026:22514-1","SUSE-SU-2026:2886-1","SUSE-SU-2026:2931-1","UBUNTU-CVE-2026-9539","USN-8550-1","openSUSE-SU-2026:11134-1","openSUSE-SU-2026:21216-1"],"status":"published","title":"libslirp TCP URG OOB Read Information Leak","description":"An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00221,"percentile":0.12791,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-125"],"published":"2026-06-24T04:37:01Z","modified":"2026-10-28T11:21:57Z","exploits":[{"source":"pocgithub","id":"quarkslab/slirp_snapshots_stateful","title":"quarkslab/slirp_snapshots_stateful","date":"2026-10-19","url":"https://github.com/quarkslab/slirp_snapshots_stateful"}],"fixes":[{"ecosystem":"Azure Linux:3","package":"libslirp","fixed_in":["4.9.3-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"libslirp","fixed_in":["4.7.0-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libslirp","fixed_in":["4.8.0-r1"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libslirp","fixed_in":["4.9.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libslirp","fixed_in":["4.8.0-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libslirp","fixed_in":["4.9.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"libslirp","fixed_in":["4.8.0-2.1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"libslirp","fixed_in":["4.6.1-1.1.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"libslirp","fixed_in":["4.8.0+2-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"libslirp","fixed_in":["4.7.0+44-5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libslirp","fixed_in":["4.7.0+44-150300.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libslirp","fixed_in":["4.7.0+44-150300.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libslirp","fixed_in":["4.7.0+44-150500.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libslirp","fixed_in":["4.7.0+44-150500.4.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libslirp","fixed_in":["4.6.1-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"libslirp","fixed_in":["4.7.0-1ubuntu3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"libslirp","fixed_in":["4.9.1-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"libslirp","fixed_in":["4.9.3+4-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"libslirp","fixed_in":["4.8.0+2-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.3-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0-r0"},{"fixed":"4.7.0-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.8.0-r0"},{"fixed":"4.8.0-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.7.0-r0"},{"fixed":"4.9.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.7.0-1","4.8.0-1","4.9.1-1","4.9.2-1","4.9.3-1","4.9.4-1","4.9.5-1"]},{"source":"osv","ecosystem":"Debian:13","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.0-1+deb13u1"}]}],"versions":["4.8.0-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-1"}]}],"versions":["4.8.0-1","4.9.1-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.0-2.1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-1.1.mga9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.0+2-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0+44-5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0+44-150300.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0+44-150300.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0+44-150500.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0+44-150500.4.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.0-1","4.0.0-2","4.1.0-1","4.1.0-2","4.1.0-2ubuntu1","4.1.0-2ubuntu2","4.1.0-2ubuntu2.1","4.1.0-2ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-1ubuntu0.2"}]}],"versions":["4.4.0-1build1","4.6.1-1","4.6.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0-1ubuntu3.1"}]}],"versions":["4.7.0-1ubuntu1","4.7.0-1ubuntu2","4.7.0-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-1ubuntu1.1"}]}],"versions":["4.8.0-1ubuntu1","4.9.1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-1ubuntu0.2"}]}],"versions":["4.4.0-1build1","4.6.1-1","4.6.1-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.7.0-1ubuntu3.1"}]}],"versions":["4.7.0-1ubuntu1","4.7.0-1ubuntu2","4.7.0-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.1-1ubuntu1.1"}]}],"versions":["4.8.0-1ubuntu1","4.9.1-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.3+4-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.0+2-160000.3.1"}]}]}],"products":[{"vendor":"freedesktop.org","product":"libslirp"},{"vendor":"slirp","product":"libslirp"}],"references":[{"url":"https://gitlab.freedesktop.org/slirp/libslirp/-/work_items/93","tags":["issue-tracking","exploit","report","web"]},{"url":"https://gitlab.freedesktop.org/slirp/libslirp/-/commit/927bca7344e31fd58e2f7afaca784aad4400eb84","tags":["patch","fix"]},{"url":"https://gitlab.freedesktop.org/slirp/libslirp/-/releases/v4.9.2","tags":["release-notes","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9539","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-4243-hp56-4m7f"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-9539","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9539.json","tags":["advisory"]},{"url":"https://gitlab.freedesktop.org/slirp/libslirp/","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-9539","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0306.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35786","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/6UPWKZGJYGWQEVDO5XRTPSVFGDX2BIZC/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622452-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268903","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9539","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622514-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262886-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262931-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-9539","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9539","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8550-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-9539","title":"libslirp TCP URG OOB Read Information Leak","description":"An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).","status":"published","published":"2026-06-24T04:37:01.955Z","modified":"2026-06-24T12:39:59.831Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T13:42:37.965383Z"}],"euvd":[{"id":"EUVD-2026-38654","description":"An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).","status":"published","published":"2026-06-24T04:37:01Z","modified":"2026-06-24T12:39:59Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:31.123469Z"}],"ghsa":[{"id":"GHSA-4243-hp56-4m7f","title":"An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in...","description":"An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).","status":"published","published":"2026-06-24T06:31:46Z","modified":"2026-06-24T06:31:51Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:08:57.478089Z"}],"nvd":[{"id":"CVE-2026-9539","description":"An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).","status":"published","published":"2026-06-24T05:17:31.1Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:25.288279Z"}],"osv":[{"id":"BELL-CVE-2026-9539","status":"published","published":"2026-06-26T06:12:35.66611Z","modified":"2026-07-03T07:15:07.322172624Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:27.468539Z"},{"id":"CVE-2026-9539","title":"libslirp TCP URG OOB Read Information Leak","description":"An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).","status":"published","published":"2026-06-24T04:37:01.955Z","modified":"2026-10-28T11:21:57.113341611Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:45:20.931171Z"},{"id":"DEBIAN-CVE-2026-9539","description":"An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).","status":"published","published":"2026-06-24T05:17:31.1Z","modified":"2026-10-26T11:47:37.398293481Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:46:07.324252Z"},{"id":"UBUNTU-CVE-2026-9539","description":"An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).","status":"published","published":"2026-06-24T05:17:00Z","modified":"2026-07-15T19:45:37.774769347Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:44.071534Z"},{"id":"AZL-90912","title":"CVE-2026-9539 affecting package libslirp for versions less than 4.9.3-1","description":"An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).","status":"published","published":"2026-06-24T05:17:31Z","modified":"2026-08-28T17:56:26.224293Z","updated_at":"2026-11-02T15:28:11.397546Z"},{"id":"MGASA-2026-0306","title":"Updated libslirp packages fix a security vulnerability","description":"The updated packages fix a security vulnerability:\nTCP URG OOB Read Information Leak. (CVE-2026-9539)\n","status":"published","published":"2026-07-28T17:06:56Z","modified":"2026-07-28T17:15:05.287987762Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11134-1","title":"libslirp-devel-4.9.3+4-1.1 on GA media","description":"These are all security issues fixed in the libslirp-devel-4.9.3+4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-27T00:00:00Z","modified":"2026-06-29T09:45:06.974388014Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21216-1","title":"Security update for libslirp","description":"This update for libslirp fixes the following issue\n\n- CVE-2026-9539: TCP URG out of bounds heap read information leak (bsc#1268903).\n","status":"published","published":"2026-07-02T09:52:17Z","modified":"2026-07-03T11:00:08.104571408Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22452-1","title":"Security update for libslirp","description":"This update for libslirp fixes the following issue\n\n- CVE-2026-9539: TCP URG out of bounds heap read information leak (bsc#1268903).\n","status":"published","published":"2026-06-30T09:18:34Z","modified":"2026-07-04T18:24:19.091385564Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:22514-1","title":"Security update for libslirp","description":"This update for libslirp fixes the following issue\n\n- CVE-2026-9539: TCP URG out of bounds heap read information leak (bsc#1268903).\n","status":"published","published":"2026-07-03T12:51:10Z","modified":"2026-07-09T18:24:09.299174661Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2886-1","title":"Security update for libslirp","description":"This update for libslirp fixes the following issues:\n  \n- CVE-2026-9539: TCP URG out of bounds heap read information leak (bsc#1268903).\n","status":"published","published":"2026-07-13T10:09:11Z","modified":"2026-07-14T09:15:06.396739209Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:2931-1","title":"Security update for libslirp","description":"This update for libslirp fixes the following issues:\n\n- CVE-2026-9539: TCP URG out of bounds heap read information leak (bsc#1268903).\n","status":"published","published":"2026-07-13T18:43:57Z","modified":"2026-07-15T10:00:06.163997867Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"USN-8550-1","title":"libslirp vulnerability","description":"It was discovered that libslirp incorrectly handled TCP urgent data. A\nprivileged attacker inside a guest VM could possibly use this issue to\nobtain sensitive information from the host process memory.","status":"published","published":"2026-07-15T13:59:22Z","modified":"2026-07-15T20:00:54.833333215Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}