CVE-2026-115449: Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest

Description

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Attack vector

Network

Complexity

High

Privileges

Low

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 15% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

RH

Red Hat Enterprise Linux 10 · Red Hat

All versions, or not specified · source: vendor

RH

Red Hat Enterprise Linux 8 · Red Hat

All versions, or not specified · source: vendor

RH

Red Hat Enterprise Linux 9 · Red Hat

All versions, or not specified · source: vendor

RH

Red Hat OpenShift Container Platform 4 · Red Hat

All versions, or not specified · source: vendor