Description

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-22T09:17:06.073Z",
  "pubdate": "2026-09-22T09:17:06.073Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability exists within the libslirp library, specifically affecting the DHCPv6 and TFTP response builders. The vulnerability stems from insufficient bounds checking when processing guest-supplied options in environments configured with a non-default, small interface Maximum Transmission Unit (MTU).\nAn unauthenticated, local attacker acting from within the guest virtual machine can leverage this flaw to send crafted DHCPv6 or TFTP packets to the host. Successful exploitation leads to a heap-based buffer overflow, allowing the injection of arbitrary content into the host's memory space. This can result in a denial of service (application crash) or potential remote code execution within the host process, compromising the integrity and security of the virtualization host.\nThe risk is primarily constrained to non-default configurations where the MTU is tuned to small values. While the default MTU settings remain unaffected, the potential for code execution renders this a high-severity flaw. Exploitation does not require prior authentication, and the vulnerability is triggered via the network stack communication between the guest and host.",
  "technicalDetails": "The vulnerability resides in the packet construction logic of libslirp, specifically during the handling of DHCPv6 CLIENTID options and TFTP blksize options. When a guest submits these options, the library attempts to build a response packet based on the received parameters. The root cause is an inadequate validation of the response buffer size relative to the MTU of the virtual network interface.\nIn scenarios where the interface MTU is intentionally set to a small value, the library fails to enforce strict boundaries when copying the guest-provided option values into the pre-allocated heap buffer. Because the length and content of the options are user-controlled, an attacker can supply an oversized payload that exceeds the buffer capacity, facilitating a heap-based overflow.\nThe attack flow proceeds as follows: First, the attacker triggers the DHCPv6 or TFTP service within the guest environment. Second, the attacker crafts a malicious packet containing a crafted DHCPv6 CLIENTID option or a TFTP blksize option designed to maximize the overflow potential. Third, when libslirp parses these options to construct the response, it performs an unchecked memory copy operation (e.g., memcpy or equivalent) from the guest-supplied buffer into the heap-allocated response structure. Finally, the excessive data overwrites adjacent heap metadata or critical data structures within the host process memory.\nBy controlling the content and length of the overflow, an attacker can influence the host's heap layout. This primitive allows for the corruption of heap chunks, potentially overwriting function pointers or object vtables. If successfully weaponized, this corruption leads to arbitrary code execution, allowing the attacker to execute malicious instructions with the privileges of the libslirp process on the host. If code execution is not achievable, the resulting heap corruption will inevitably trigger a crash of the host process, causing a denial of service.\nThis vulnerability highlights a critical failure in input validation during protocol response construction. Since the library processes these requests as part of the host-guest communication channel, there is no requirement for authentication or elevated privileges from the attacker's perspective; the primary requirement is the reachability of the DHCPv6 or TFTP services configured on the virtual interface."
}