CVE-2026-120831: Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service
Vulnerability summary
CVE-2026-120831 is a medium (CVSS 6.5) Out-of-bounds Write vulnerability in libslirp Debian. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.5% of scored vulnerabilities.
Not severe (CVSS 6.5, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 03-11-2026PublishedVulnerability first disclosed.
- 03-11-2026Last modifiedVulnerability information updated.
Description
A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST6.5MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.27%
Chance of exploitation in the next 30 days
Percentile
19%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Debian1 product
- libslirpAll versions (No fix recorded)
1 vendor · 1 product
