Heap-Based Buffer Overflow in libslirp DHCPv6 and TFTP Builders

CVE-2026-95508 describes a heap-based buffer overflow vulnerability residing in the DHCPv6 and TFTP response builders within the libslirp library. The vulnerability is triggered when the host network interface is configured with an unusually small Maximum Transmission Unit (MTU). Under these conditions, the library fails to properly validate the length of guest-supplied DHCPv6 CLIENTID options or TFTP blksize options. By providing malformed options, an attacker within a guest virtual machine can overflow the reply buffer with controlled content and length. This flaw impacts the host process context, enabling potential denial of service or arbitrary code execution. Systems utilizing the default interface MTU are not susceptible to this specific overflow. This vulnerability highlights the risks associated with guest-to-host interface boundary validation in virtualized network stacks.

Impact

Successful exploitation allows a malicious actor operating within a guest virtual machine to compromise the host process hosting the libslirp instance. This can result in a crash leading to denial of service for network services or, in scenarios where the heap layout is predictable, arbitrary code execution with the privileges of the host process. The vulnerability affects environments using non-default, small MTU configurations, which may be common in specific containerized or restricted network segments.

Recommendation

Identify and update all virtualization environments or applications embedding libslirp to a patched version once released by the maintainers. Prioritize systems where non-default MTU settings are applied to virtual network interfaces. Review virtualization configurations to enforce safe MTU defaults and implement network micro-segmentation to restrict the ability of untrusted guests to interact with sensitive TFTP or DHCPv6 management services. Monitor host process memory behavior for abnormal crash patterns or unexpected child process spawning related to networking components.