CVE-2026-120830 in Red Hat
Summary
by MITRE • 11/03/2026
A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in libslirp within the icmp_forward_error function represents a critical boundary condition failure during network emulation processing. This component is integral to user-mode networking solutions such as QEMU and Docker, where it facilitates communication between virtualized guests or containers and external networks by handling packet translation and forwarding. The specific flaw occurs when the system constructs an ICMP error response message intended for the guest environment. In this process, libslirp extracts information from a quoted original IPv4 packet to include in the error payload. However, the implementation fails to validate that the length field specified within the IP header of the quoted packet does not exceed the actual size of the buffer containing that packet data. This lack of clamping means the application trusts the metadata provided by potentially untrusted input without verifying its consistency against physical memory constraints.
From a technical perspective, this oversight leads directly to an out-of-bounds heap read condition. When a truncated or malformed IPv4 packet is processed, the ICMP error generation routine attempts to copy data based on the header-specified length rather than the actual available buffer size. If the specified length exceeds the allocated memory region for that specific packet instance, the application will read beyond its designated boundaries into adjacent heap memory segments. This behavior constitutes a classic information disclosure vulnerability where sensitive host memory contents are inadvertently included in the ICMP error packet sent back to the guest or container. The attacker does not need to execute arbitrary code on the host; rather, they simply need to craft and send specific malformed network packets that trigger this erroneous length calculation within the virtualization layer.
The operational impact of this vulnerability is significant due to its potential for remote exploitation in multi-tenant environments. Since libslirp is commonly used in container runtimes like Docker and Kubernetes as well as QEMU-based virtual machines, an attacker with access to a guest or container network interface can exploit this flaw to leak host memory contents. This could expose sensitive data such as cryptographic keys, session tokens, internal application secrets, or other processes' private information residing on the same physical host. The attack vector is remote and requires no authentication if the virtualized environment exposes its networking stack to untrusted inputs. Furthermore, because ICMP error messages are often generated automatically in response to network anomalies, this vulnerability can be triggered passively by normal but maliciously crafted traffic patterns, making detection difficult without specialized monitoring tools focused on memory safety violations or anomalous packet sizes.
This flaw aligns with CWE-125 Out-of-bounds Read and CWE-200 Exposure of Sensitive Information to an Unauthorized Actor under the Common Weakness Enumeration framework. In terms of offensive security tactics, it maps closely to ATT&CK technique T1074 Data Staged or Exfiltration Over C2 Channel if used for data staging, but more accurately reflects initial reconnaissance and credential access through memory scraping techniques often associated with lateral movement in compromised environments. The vulnerability highlights the risks inherent in trusting network protocol headers without rigorous validation of buffer boundaries during packet processing operations.
Mitigation strategies must focus on both immediate patching and long-term architectural improvements. Organizations utilizing affected versions of libslirp should apply vendor-provided security updates that enforce strict length checks before accessing quoted packet data. Developers implementing similar networking logic in other systems must ensure that all protocol header fields are validated against the actual buffer size prior to any read operations. Additionally, deploying network intrusion detection systems capable of identifying malformed ICMP packets or unusual memory access patterns can provide an additional layer of defense. For containerized environments, enforcing strict network policies and limiting guest-to-host communication paths reduces the attack surface available for exploiting this specific flaw in libslirp. Regular auditing of virtualization components against known vulnerability databases is essential to maintain security posture in cloud-native infrastructures.