CVE-2026-120831

MEDIUM

MEDIUM Priority: 0.02 BB Relevance: 58/100

Published: 2026-11-03 Modified: 2026-11-05 First seen: 2026-11-03 Status: active

Attack Surface

Adjacent Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Adjacent

AC: Low

PR: None

UI: None

S: Unchanged

C: None

I: None

A: High

Description

A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service.