VulnSocial

CVE-2026-120830

LOWCVSS 7.4 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-125

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-11-03: 211-03
Referenced assets1 URL
By indicator
Full discourse2 posts
  • VulnTracker@vuln_tracker

    libslirp CVE-2026-120830 (CVSS 7.4): icmp_forward_error() takes the quoted packet length without clamping it, so a malformed packet can cause an out-of-bounds heap read and leak host memory into the ICMP error sent to a guest or container. Red Hat lists RHEL 8, 9, 10 and OpenShift 4 and 5 as affected. No update or workaround yet. VulnTracker recommends applying Red Hat updates when they ship. Details: http://vulntracker.io/cves/CVE-2026-120830 #libslirp #RedHat #InfoSec

    00010149
    911 followersView on X
  • Upwind Security MDR@UpwindMDR

    🚨HIGH - libslirp ICMP error quoted-length OOB read info leak (CVE-2026-120830) libslirp’s icmp_forward_error() uses the IPv4 header’s quoted-packet length to construct ICMP error replies without clamping to the received buffer size. A truncated/malformed IPv4 packet triggers an out-of-bounds heap read, leaking host memory back to a guest/container via the ICMP error payload. 👉Affected: libslirp; container-tools:rhel8/libslirp; openshift/ose-rhel-coreos-8; openshift/ose-rhel-coreos-9

    0000048
    380 followersView on X

Explore more

Back to dashboard