CVE-2026-9539
Description
An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).
Summary dbcve.org
An integer underflow and out-of-bounds heap read vulnerability exists in libslirp's TCP urgent data handling (sosendoob function) before version v4.9.2. A privileged guest VM attacker with root or CAP_NET_RAW capabilities can send crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp), enabling gigabytes of sensitive host-process heap memory to be leaked.
Mitigation
Upgrade libslirp to v4.9.2 or later on hypervisor hosts. If upgrading is not immediately feasible, restrict VM privileges and network capabilities to prevent untrusted or non-privileged VMs from having CAP_NET_RAW access.