What happened
libslirp allocates two 128 KiB buffers for send/receive data and uses ring‑buffer pointers. An integer under‑flow in the TCP urgent‑pointer check allows reads beyond the valid data region, leaking the entire receive buffer—including stale memory—from the host to the guest. Because the over‑read stays within the custom allocator, AddressSanitizer and many fuzzers miss it, leaving the vulnerability undiscovered until researchers at STAR Labs SG reported it in May 2026. No public exploit is known, but any attacker controlling TCP traffic inside a VM can trigger the leak, creating a potential VM‑escape data‑exfiltration vector.
Why it matters for trust and compliance
- The flaw demonstrates the need for continuous, evidence‑based testing of custom memory‑management code, mapping to the control objective of robust vulnerability management across development lifecycles.
- Enable audit‑ready evidence of vulnerability detection through advanced fuzzing pipelines.
- Support control mapping to frameworks (e.g., NIST CSF 2.0) that require demonstrable secure‑development practices.
Who is affected
CLOUD_INFRA VENDOR_TYPE_CODE: CLOUD_HOST
Recommended actions
- Upgrade libslirp/QEMU to the patched version released after CVE‑2026‑9539.
- Integrate state‑machine‑aware fuzzing (LibAFL‑Qemu with snapshotting) into CI/CD.
- Add custom detection rules for integer under‑flows in ring‑buffer logic.
- Record remediation steps and testing artifacts in your control repository.
Details
- CVEs
- CVE-2026-9539