CVE-2026-95508

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.

This vulnerability is rated as Moderate impact because triggering the memory corruption requires an uncommon host configuration where the network interface MTU is manually set below 1280 bytes. Default installations that operate with a standard 1500-byte MTU are safe from guest-initiated buffer overflows.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not configure SlirpConfig.if_mtu below the IPv6 minimum link MTU of 1280.