AZL-112679
Dashboard / Vulnerabilities / AZL-112679
Summary: CVE-2026-120830 affecting package libslirp 4.9.6-1
Details: A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.
References: https://nvd.nist.gov/vuln/detail/CVE-2026-120830
Affected packages
Package
Name: libslirp
Purl: pkg:rpm/azure-linux/libslirp
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -None
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
