This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-9539 →

DEBIAN-CVE-2026-9539

An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hype...

Original description

The description as published by the source.

An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libslirp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 libslirp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.0-1+deb13u1"}]}]

Debian:14 libslirp

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.2-1"}]}]

References

advisory security-tracker.debian.org