CVE-2026-9539
- Source
- https://cve.org/CVERecord?id=CVE-2026-9539
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9539.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-9539
- Downstream
AZL (1)
BELL (1)
DEBIAN (1)
MGASA (1)
openSUSE (2)
UBUNTU (1)
- Related
- Published
- 2026-06-24T04:37:01Z
- Modified
- 2026-10-28T11:21:57Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
- Summary
- libslirp TCP URG OOB Read Information Leak
- Details
-
An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp).
- Database specific
{ "cna_assigner": "STAR_Labs", "cwe_ids": [ "CWE-125" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9539.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9539.json
- https://gitlab.freedesktop.org/slirp/libslirp/-/releases/v4.9.2
- https://nvd.nist.gov/vuln/detail/CVE-2026-9539
- https://gitlab.freedesktop.org/slirp/libslirp/-/work_items/93
- https://gitlab.freedesktop.org/slirp/libslirp/-/commit/927bca7344e31fd58e2f7afaca784aad4400eb84
- https://gitlab.freedesktop.org/slirp/libslirp/
Affected packages
Git / gitlab.freedesktop.org/slirp/libslirp
Affected ranges
- Type
- GIT
- Repo
- https://gitlab.freedesktop.org/slirp/libslirp
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "4.9.2" } ], "source": "AFFECTED_FIELD", "strategy": "ChangesAt" }, { "range": [ { "fixed": "927bca7344e31fd58e2f7afaca784aad4400eb84" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
Other
release_0_10_0
release_0_10_1
release_0_10_2
release_0_6_0
release_0_6_1
release_0_7_0
release_0_7_1
release_0_8_1
release_0_8_2
release_0_9_0
release_0_9_1
v0.*
v0.10.0
v0.10.1
v0.10.2
v0.10.3
v0.10.4
v0.10.5
v0.10.6
v0.11.0-rc0
v0.12.0
v0.12.0-rc0
v0.12.0-rc1
v0.12.0-rc2
v0.12.1
v0.13.0
v0.13.0-rc0
v0.13.0-rc1
v0.13.0-rc2
v0.13.0-rc3
v0.14.0-rc0
v0.14.0-rc1
v0.15.0
v0.15.0-rc0
v0.15.0-rc1
v0.15.0-rc2
v0.15.1
v0.6.0
v0.6.1
v0.7.0
v0.7.1
v0.8.1
v0.8.2
v0.9.0
v0.9.1
v1.*
v1.0
v1.0-rc0
v1.0-rc1
v1.0-rc2
v1.0-rc3
v1.0-rc4
v1.0.1
v1.1-rc0
v1.1-rc1
v1.1-rc2
v1.1.0
v1.1.0-rc2
v1.1.0-rc3
v1.1.0-rc4
v1.1.1
v1.1.2
v1.2.0
v1.2.0-rc0
v1.2.0-rc1
v1.2.0-rc2
v1.2.0-rc3
v1.3.0
v1.3.0-rc0
v1.3.0-rc1
v1.3.0-rc2
v1.3.1
v1.4.0
v1.4.0-rc0
v1.4.0-rc1
v1.4.0-rc2
v1.5.0
v1.5.0-rc0
v1.5.0-rc1
v1.5.0-rc2
v1.5.0-rc3
v1.5.1
v1.5.2
v1.5.3
v1.6.0
v1.6.0-rc0
v1.6.0-rc1
v1.6.0-rc2
v1.6.0-rc3
v1.6.1
v1.6.2
v1.7.0
v1.7.0-rc0
v1.7.0-rc1
v1.7.0-rc2
v1.7.1
v1.7.2
v2.*
v2.0.0
v2.0.0-rc0
v2.0.0-rc1
v2.0.0-rc2
v2.0.0-rc3
v2.0.1
v2.0.2
v2.1.0
v2.1.0-rc0
v2.1.0-rc1
v2.1.0-rc2
v2.1.0-rc3
v2.1.0-rc4
v2.1.0-rc5
v2.1.1
v2.10.0
v2.10.0-rc0
v2.10.0-rc1
v2.10.0-rc2
v2.10.0-rc3
v2.10.0-rc4
v2.11.0
v2.11.0-rc0
v2.11.0-rc1
v2.11.0-rc2
v2.11.0-rc3
v2.11.0-rc4
v2.11.0-rc5
v2.11.1
v2.11.2
v2.12.0
v2.12.0-rc0
v2.12.0-rc1
v2.12.0-rc2
v2.12.0-rc3
v2.12.0-rc4
v2.12.1
v2.2.0
v2.2.0-rc0
v2.2.0-rc1
v2.2.0-rc2
v2.2.0-rc3
v2.2.0-rc4
v2.2.0-rc5
v2.2.1
v2.3.0
v2.3.0-rc0
v2.3.0-rc1
v2.3.0-rc2
v2.3.0-rc3
v2.3.0-rc4
v2.3.1
v2.4.0
v2.4.0-rc0
v2.4.0-rc1
v2.4.0-rc2
v2.4.0-rc3
v2.4.0-rc4
v2.4.0.1
v2.5.0
v2.5.0-rc0
v2.5.0-rc1
v2.5.0-rc2
v2.5.0-rc3
v2.5.0-rc4
v2.5.1
v2.5.1.1
v2.6.0
v2.6.0-rc0
v2.6.0-rc1
v2.6.0-rc2
v2.6.0-rc3
v2.6.0-rc4
v2.6.0-rc5
v2.7.0
v2.7.0-rc0
v2.7.0-rc1
v2.7.0-rc2
v2.7.0-rc3
v2.7.0-rc4
v2.7.0-rc5
v2.8.0
v2.8.0-rc0
v2.8.0-rc1
v2.8.0-rc2
v2.8.0-rc3
v2.8.0-rc4
v2.8.1
v2.8.1.1
v2.9.0
v2.9.0-rc0
v2.9.0-rc1
v2.9.0-rc2
v2.9.0-rc3
v2.9.0-rc4
v2.9.0-rc5
v3.*
v3.0.0
v3.0.0-rc0
v3.0.0-rc1
v3.0.0-rc2
v3.0.0-rc3
v3.0.0-rc4
v3.1.0
v3.1.0-rc0
v3.1.0-rc1
v3.1.0-rc2
v3.1.0-rc3
v3.1.0-rc4
v3.1.0-rc5
v4.*
v4.0.0
v4.0.0-rc0
v4.1.0
v4.2.0
v4.3.0
v4.3.1
v4.6.0
v4.8.0
v4.9.0
v4.9.1
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9539.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"239007896636702122169078612463953573864",
"337282997243644609108989416181222452433",
"178625992849460555765145317077778257029",
"184557131165001901036770029464061942995",
"96716069151448504750692702564817460377",
"166030774534557820525032882621334080242",
"61848011806209136427149812420009013454",
"217160008481919143645885049306549777596",
"308859922090318657823288760968705972357",
"23030980690315228399985684064480965268",
"299280594292059674835186776803544821527",
"35498563452868244884056352465768521512",
"212409195781232817855624459056561059528",
"182388760416958016298692469776657523389",
"282206583731902259232101251941086039962",
"240657327437796455257550487886416230728",
"178049144235531965192721677697866889421",
"238350758681963578877791007657114274204",
"104225265919482662388326348755058998338",
"218474752701968043135241466598022336369",
"240467897878351026182507614438263338237",
"178168532672849104981198212920879607542",
"254049339972125736377028777566799196808",
"84437414220090896472861269996227030576",
"113803664713290153657600847921322147500",
"82589993409659308254850275808774935809",
"38511911765769201751096252696269515127",
"225609287813632298761664683574024318498",
"147874716796078577207499932340247040184",
"99073340872143969660824489981059561708",
"235789583167724489861945154282605105799",
"63450638621882815207302710510008805685",
"44389282954897825084122780251197318834",
"269856345795476506225779770699364303518",
"19514724741568785828614570070928746120",
"97899093523281214094137431967723443286"
],
"threshold": 0.9
},
"id": "CVE-2026-9539-0cf730b2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/slirp/libslirp@927bca7344e31fd58e2f7afaca784aad4400eb84",
"target": {
"file": "src/socket.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "225444295741893726390092631938201060872",
"length": 1229
},
"id": "CVE-2026-9539-2f89bcfb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/slirp/libslirp@927bca7344e31fd58e2f7afaca784aad4400eb84",
"target": {
"file": "src/socket.c",
"function": "sosendoob"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "237845057052286332897024139733583784233",
"length": 1824
},
"id": "CVE-2026-9539-8cdb7d29",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://gitlab.freedesktop.org/slirp/libslirp@927bca7344e31fd58e2f7afaca784aad4400eb84",
"target": {
"file": "src/socket.c",
"function": "sowrite"
}
}
]
vanir_signatures_modified
"2026-10-28T11:21:57Z"