CVE-2026-95508

HIGH

MEDIUM Priority: 0.04 BB Relevance: 65/100

Published: 2026-09-22 Modified: 2026-11-03 First seen: 2026-11-03 Status: active

Attack Surface

Network No Auth No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network

AC: High

PR: None

UI: None

S: Unchanged

C: None

I: High

A: High

Description

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.