Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure

Summary

A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.

Remediation

1. Inventory every Red Hat Red Hat Enterprise Linux 10 deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://access.redhat.com/security/cve/CVE-2026-120830
• Referencehttps://bugzilla.redhat.com/show_bug.cgi?id=2565424
• Referencehttps://gitlab.freedesktop.org/slirp/libslirp/-/commit/21b33a6c5588af9f58d15e528fdc1019452708e4