Log in Start free

Vulnerability · Published Nov 3, 2026 · Assigned by redhat

CVE-2026-120830Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure

High 7.4

In plain English

A high-severity out-of-bounds read in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.2%top 87.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libslirpno fix listedDEBIAN-CVE-2026-120830
Debian:13libslirpno fix listedDEBIAN-CVE-2026-120830
Debian:14libslirpno fix listedDEBIAN-CVE-2026-120830
Ubuntu:22.04:LTSlibslirpno fix listedUBUNTU-CVE-2026-120830
Ubuntu:24.04:LTSlibslirpno fix listedUBUNTU-CVE-2026-120830
Ubuntu:26.04:LTSlibslirpno fix listedUBUNTU-CVE-2026-120830
Ubuntu:26.10libslirpno fix listedUBUNTU-CVE-2026-120830

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat Enterprise Linux 10 see references
Red Hat Red Hat Enterprise Linux 8 see references
Red Hat Red Hat Enterprise Linux 9 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 4 see references
Red Hat Red Hat OpenShift Container Platform 5 see references

Weakness: CWE-125 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References