Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-22T07:27:49 libslirp: libslirp: heap buffer overflow in DHCPv6/TFTP response builders on small interface MTU 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H CWE-787

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.

This vulnerability is rated as Moderate impact because triggering the memory corruption requires an uncommon host configuration where the network interface MTU is manually set below 1280 bytes. Default installations that operate with a standard 1500-byte MTU are safe from guest-initiated buffer overflows. Red Hat would like to thank Stuart Thomas for reporting this issue. Do not configure SlirpConfig.if_mtu below the IPv6 minimum link MTU of 1280. Red Hat Enterprise Linux 10 Affected libslirp Red Hat Enterprise Linux 8 Affected container-tools:rhel8/libslirp Red Hat Enterprise Linux 9 Affected libslirp Red Hat OpenShift Container Platform 4 Affected libslirp Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-95508 https://nvd.nist.gov/vuln/detail/CVE-2026-95508