CVE-2026-95507

An out-of-bounds read was found in the NC-SI OEM response handler of libslirp. A truncated NC-SI OEM Ethernet frame causes ncsi_rsp_handler_oem() to read up to 4 bytes beyond the supplied packet length and reflect the value into the response sent to the guest, resulting in guest-observable disclosure of adjacent host process memory.

Moderate: A flaw in libslirp's NC-SI OEM response handler allows a malicious guest to trigger an out-of-bounds read, leading to the disclosure of up to 4 bytes of adjacent host RX-buffer memory. This bounded memory disclosure is guest-triggerable and does not involve write access or code execution on the host.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.