CVE-2026-115449 in Red Hat
Summary
by MITRE • 10/22/2026
A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified within libslirp represents a critical failure in network address translation and packet handling logic, specifically affecting the integrity of user-mode networking environments commonly utilized by virtualization platforms such as QEMU. Libslirp serves as the software implementation for SLIP over TCP/IP, providing guest operating systems with simulated network connectivity when direct hardware access is not available or desired. The core technical flaw resides in the ICMP protocol handling subsystem, specifically during the processing of echo requests and their subsequent replies. When a virtual machine sends an ICMP ping request to an external destination, libslirp forwards this packet through the host's network stack. Upon receiving the response from the actual target on the physical network, the library is responsible for constructing the reply that will be sent back to the guest VM. In this specific scenario, the code fails to correctly update the length field of the ICMP echo reply header to match the size of the data actually received from the host's real IP address context.
This discrepancy in packet length triggers a cascade of negative effects due to how memory buffers are managed and interpreted by both the guest OS network stack and the virtualization layer. Under normal operating conditions, where standard ICMP sockets function correctly within the user-mode networking framework, this bug may remain latent or have limited impact because other validation mechanisms might mask the issue. However, under specific edge cases where the normal ICMP socket is unavailable or fails to initialize properly, libslirp falls back to alternative handling paths that are more susceptible to this length mismatch error. The failure to adjust the reply length means that the packet structure becomes malformed relative to expectations set by standard networking protocols. This structural inconsistency allows internal host state information, particularly the real IP address of the host machine acting as the gateway or NAT device, to be inadvertently included in the payload sent back to the guest VM.
The operational impact of this vulnerability is severe because it directly compromises network isolation, a fundamental security boundary between virtual machines and the underlying host infrastructure. User-mode networking relies on strict abstraction layers to ensure that guests cannot perceive or interact with the physical network topology beyond what is explicitly permitted through NAT rules. By leaking the host's real IP address, the vulnerability breaks this isolation model. An attacker who has gained control of a guest VM can exploit this information leak to map the internal network structure more accurately than intended. This reconnaissance capability facilitates further attacks against the host or other guests on the same physical network segment by providing precise targeting data that should remain hidden behind the NAT layer. It effectively reduces the security posture from one of strong isolation to one where the guest has partial visibility into the host's identity, potentially aiding in targeted exploitation attempts such as ARP spoofing or direct connection attacks if additional misconfigurations exist.
From a classification perspective, this vulnerability aligns with CWE-200: Information Exposure and CWE-459: Incomplete Cleanup, reflecting both the unintended disclosure of sensitive network data and the failure to properly manage state during error handling paths. It also maps to MITRE ATT&CK techniques related to Network Service Discovery (T1046) and potentially Defense Evasion if used to bypass isolation controls. The root cause is a logic error in buffer management where input validation and output formatting are not synchronized, leading to the leakage of internal state information through standard protocol responses.
Mitigation strategies must focus on immediate patching of libslirp to versions that correct the ICMP echo reply length calculation. Administrators should verify their virtualization environments for updated packages and ensure that all guest instances are restarted after applying patches to clear any cached network states or connections that might still be vulnerable during active sessions. In the interim, where updates cannot be applied immediately, restricting outbound traffic from guests via strict firewall rules on the host can limit the utility of this vulnerability by preventing ICMP echo requests from reaching external targets in a way that triggers the flawed code path. Additionally, enabling advanced network monitoring tools to detect anomalous packet sizes or unexpected IP address disclosures within guest-to-host communications can help identify exploitation attempts before they lead to broader compromise. Long-term remediation should involve rigorous code review of all user-mode networking components to ensure that buffer lengths and payload data are consistently validated across all protocol handlers, not just ICMP, to prevent similar information leaks in other network services.