Executive brief
libslirp is a user-mode network stack library used in virtualization and containerization products to provide guest network access. A heap buffer overflow in its DHCPv6 and TFTP response handlers allows an attacker to crash the host process or execute arbitrary code if the interface MTU is configured below the IPv6 minimum of 1280 bytes—a non-default configuration. This affects host-level processes and could compromise the virtualization platform.
Technical details
A heap-based buffer overflow exists in the DHCPv6 CLIENTID option and TFTP blksize option handling when processing guest-supplied input. The vulnerability is triggered only when SlirpConfig.if_mtu is configured below 1280 bytes, allowing an attacker to overflow the reply buffer with controlled content and length, resulting in code execution or denial of service in the host process. Patches are required to validate option lengths against the configured MTU.
Affected products
- libslirp libslirp
Timeline
- 2026-09-22: disclosed