CVE-2026-95508 — Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu
A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIE…
Published: 2026-09-22 · CVSS: 7.4 · CVSS 3.1
A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7