Description
An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| freedesktop.org | libslirp | < 4.9.2 | 4.9.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libslirp | 4.9.2-1 | — |
| Debian 13 | libslirp | 4.8.0-1+deb13u1 | — |
| Debian 12 | libslirp | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | libslirp | 4.9.1-1ubuntu1.1 | USN-8550-1 |
| Ubuntu 25.10 | libslirp | No fix yet | — |
| Ubuntu 24.04 LTS | libslirp | 4.7.0-1ubuntu3.1 | USN-8550-1 |
| Ubuntu 22.04 LTS | libslirp | 4.6.1-1ubuntu0.2 | USN-8550-1 |
| Ubuntu 20.04 LTS | libslirp | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | libslirp | 4.7.0+44-150500.4.3.1 | SUSE-SU-2026:2931-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLE Micro 6.1 | libslirp | 4.8.0+2-slfo.1.1_2.1 | SUSE-SU-2026:22452-1 |
| SLE Micro 6.0 | libslirp | 4.7.0+44-5.1 | SUSE-SU-2026:22514-1 |
| SLE Micro 5.5 | libslirp | 4.7.0+44-150500.4.3.1 | SUSE-SU-2026:2931-1 |
| SLE Micro 5.4 | libslirp | 4.7.0+44-150300.18.1 | SUSE-SU-2026:2886-1 |
| SLE Micro 5.3 | libslirp | 4.7.0+44-150300.18.1 | SUSE-SU-2026:2886-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libslirp | 4.9.3+4-1.1 | openSUSE-SU-2026:11134-1 |
| openSUSE Leap 16.0 | libslirp | 4.8.0+2-160000.3.1 | openSUSE-SU-2026:21216-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | qemu +26 | 10:3.1.0-8.amzn2.0.26 | ALAS2-2026-3866 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | libslirp | 4.9.3-1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
quarkslab/slirp_snapshots_stateful ★ 2 · Oct 19, 2026
PoC for the «Snapshotting our way to CVE-2026-9539» blogpost
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 8
- ALAS2-2026-3866 Important: qemu security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 17, 2026
- USN-8550-1 libslirp vulnerability Ubuntu Security Notices (USN) · Jul 15, 2026
- SUSE-SU-2026:2931-1 Security update for libslirp SUSE / openSUSE Security Updates · Jul 15, 2026
- SUSE-SU-2026:2886-1 Security update for libslirp SUSE / openSUSE Security Updates · Jul 14, 2026
- SUSE-SU-2026:22514-1 Security update for libslirp SUSE / openSUSE Security Updates · Jul 9, 2026
- SUSE-SU-2026:22452-1 Security update for libslirp SUSE / openSUSE Security Updates · Jul 4, 2026
- openSUSE-SU-2026:21216-1 Security update for libslirp SUSE / openSUSE Security Updates · Jul 3, 2026
- openSUSE-SU-2026:11134-1 libslirp-devel-4.9.3+4-1.1 on GA media SUSE / openSUSE Security Updates · Jun 29, 2026