AZL-111020: CVE-2026-115449 affecting package libslirp 4.9.3-1

Q: Who is exposed to this issue?

Guests using libslirp user-mode networking are exposed when they can send ICMP echo requests and the normal ICMP socket is unavailable. The impact is disclosure of the host's real IP address to the guest, weakening expected NAT isolation.

Q: What conditions are required for exploitation?

An attacker needs the ability to cause ICMP echo requests from a guest using libslirp user-mode networking. The leak occurs only under the specific condition that the normal ICMP socket is unavailable.

Published Oct 22, 2026

Updated

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.

Affected Software

1 affected component

azure-linux/libslirp<=4.9.3-1

Event History

Oct 22, 2026

Advisory Published

via OSV·10:18 PM

Data Sourced

via OSV·10:18 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-115449

Frequently Asked Questions

Who is exposed to this issue?

Guests using libslirp user-mode networking are exposed when they can send ICMP echo requests and the normal ICMP socket is unavailable. The impact is disclosure of the host's real IP address to the guest, weakening expected NAT isolation.

What conditions are required for exploitation?

An attacker needs the ability to cause ICMP echo requests from a guest using libslirp user-mode networking. The leak occurs only under the specific condition that the normal ICMP socket is unavailable.

AZL-111020: CVE-2026-115449 affecting package libslirp 4.9.3-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What conditions are required for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What conditions are required for exploitation?