Is CVE-2026-9539 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9539 being exploited in the wild.

How severe is CVE-2026-9539?

Medium severity, with a CVSS score of 6.5, published 24 June 2026.

Which products and versions are affected?

Freedesktop.Org Libslirp before v4.9.2; Qemu All versions using slirp user-mode networking.

Is there a fix for CVE-2026-9539?

A patch was published on 2026-05-23: Fix authored in libslirp repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9539 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-9539?

Check whether you run Freedesktop.Org Libslirp or Qemu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9539: freedesktop.org libslirp heap OOB read in TCP urgent data handling

CVE-2026-9539 · Severity: medium · CVSS 6.5 · Published 2026-06-24

libslirp is a networking library used by virtualization software like QEMU to provide internet access to guest virtual machines. A flaw in how it handles specific network signals (TCP urgent data) allows a user inside a virtual machine to read sensitive information from the host computer's memory. This could lead to the exposure of gigabytes of data from the host process or other virtual machines, potentially including encryption keys or private communications.

Technologies: Qemu. Vendors: Freedesktop.Org, Qemu.

Quick answers

Is CVE-2026-9539 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9539 being exploited in the wild.
How severe is CVE-2026-9539?: Medium severity, with a CVSS score of 6.5, published 24 June 2026.
Which products and versions are affected?: Freedesktop.Org Libslirp before v4.9.2; Qemu All versions using slirp user-mode networking.
Is there a fix for CVE-2026-9539?: A patch was published on 2026-05-23: Fix authored in libslirp repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9539 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-9539?: Check whether you run Freedesktop.Org Libslirp or Qemu at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the `sosendoob` function within `socket.c` of libslirp due to insufficient validation of the TCP urgent pointer (`ti_urp`). An attacker with `CAP_NET_RAW` or root privileges within a guest VM can send crafted TCP segments with manipulated URG flags to inflate the `so_urgc` counter beyond the actual data present in the receive buffer (`sb_cc`). This results in an out-of-bounds read of the `sb_data` heap allocation. Furthermore, a subsequent integer underflow of `sb_cc` allows the attacker to leak up to 4GiB of host-process heap memory, which may contain sensitive data from other slirp sessions or the hypervisor itself. The issue is fixed in version 4.9.2 by capping the urgent data count to the amount of data actually available.

Affected products

freedesktop.org libslirp before v4.9.2
QEMU QEMU All versions using slirp user-mode networking

Timeline

2026-05-23: patched: Fix authored in libslirp repository
2026-06-24: disclosed: CVE-2026-9539 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.