Vulnerability record/PUBLISHED/Published Nov 3, 2026 00:00:35 UTC
CVE-2026-120830
A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.
Base score7.4/ 10
SeverityHighCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityHigh
Attack vectorAdjacentAV
Attack complexityLowAC
Privileges requiredNonePR
User interactionNoneUI
ScopeChangedS
Confidentiality impactHighC
Integrity impactNoneI
Availability impactNoneA
CVSS vector string
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering Authorityredhat
Last updatedNov 4, 2026 22:06:47 UTC
PublishedNov 3, 2026 00:00:35 UTC
ReservedNov 2, 2026 23:39:47 UTC
Credits
- Red Hat would like to thank Piyusha Akash (Manifold Operations) for reporting this issue.