CVE-2026-120830

Description

A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.

Overview

State: PUBLISHED
Assigner (CNA): redhat
CVSS severity: HIGH
CVSS score: 7.4 / 10
CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Effective score: 7.4 / 10 HIGH source: CNA overview
CWE(s): CWE-125
Reserved: 2026-11-02
Published: 2026-11-03 00:00 UTC
Last updated: 2026-11-03 00:26 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120830.json
Linked Threat: CVE-2026-120830 — Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-11-03 00:17:18 UTC
NVD last modified: 2026-11-03 01:16:50 UTC
NVD CVSS v3.1: 7.4 / 10 HIGH source: secalert@redhat.com
NVD CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Exploitability subscore: 2.8 / 10
Impact subscore: 4.0 / 10
EPSS score: 0.0022 (probability of exploitation in next 30 days)
EPSS percentile: 12.78% vs all CVEs — higher = more likely to be exploited, as of 2026-11-03

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-115651
Assigner: redhat
Published: Nov 3, 2026, 12:00:35 AM
Updated: Nov 3, 2026, 12:26:08 AM
EUVD base score (CVSS 3.1): 7.4 / 10
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EUVD-reported EPSS: 0.0000
Aliases: GHSA-r5f9-pc8m-f599

ENISA description: A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.

EUVD references (3)

Affected products (7)

Vendor	Product	Versions	Platforms
Red Hat	Red Hat Enterprise Linux 10	—	—
Red Hat	Red Hat Enterprise Linux 8	—	—
Red Hat	Red Hat Enterprise Linux 9	—	—
Red Hat	Red Hat OpenShift Container Platform 4	—	—
Red Hat	Red Hat OpenShift Container Platform 4	—	—
Red Hat	Red Hat OpenShift Container Platform 4	—	—
Red Hat	Red Hat OpenShift Container Platform 5	—	—

Vendor references (3)

References embedded in the original CVE record by the assigning CNA.

https://access.redhat.com/security/cve/CVE-2026-120830 vdb-entryx_refsource_REDHAT
RHBZ#2565424 issue-trackingx_refsource_REDHAT
https://gitlab.freedesktop.org/slirp/libslirp/-/commit/21b33a6c5588af9f58d15e528fdc1019452708e4

MITRE references (3) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

https://access.redhat.com/security/cve/CVE-2026-120830 vdb-entry, x_refsource_REDHAT
RHBZ#2565424 issue-tracking, x_refsource_REDHAT
https://gitlab.freedesktop.org/slirp/libslirp/-/commit/21b33a6c5588af9f58d15e528fdc1019452708e4

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

NVD-tagged references (3)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://access.redhat.com/security/cve/CVE-2026-120830 secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2565424 secalert@redhat.com
https://gitlab.freedesktop.org/slirp/libslirp/-/commit/21b33a6c5588af9f58d15e528fdc1019452708e4 secalert@redhat.com

Remediations (12)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CVE Database Search & Remediation Guidance

web:cvedatabase.com

Search and analyze CVE vulnerabilities with instant access to CVSS scores, affected products, and remediation guidance.

2026-11-03 11:18 UTC
The CVE Database: Curated Vulnerability Intelligence by Wiz | Wiz

web:www.wiz.io

Wiz's CVE Database curates CVE data to create easy-to-navigate profiles that cover the entire vulnerability timeline, exploit scenarios, and mitigation steps.

2026-11-03 11:18 UTC
September 2026 Critical Security Patch Update Released

web:blogs.oracle.com

For more information about the Critical Security Patch Update program, see the security vulnerability remediation practices page located on the Oracle Trust Center.

2026-11-03 10:54 UTC
CVE Vulnerabilities 2026: Critical Flaws & Fixes Hub

web:cyberupdates365.com

Track critical CVE vulnerabilities 2026 with verified enterprise patch guides. Fix zero-days across VMware, WordPress, Windows, and cloud infrastructure.

2026-11-03 10:54 UTC
Cisco Meraki Security Hardening Release: October 2026

web:sec.cloudapps.cisco.com

As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. These vulnerabilities were found during internal testing and are not known to be actively exploited. To assist customers in patching ...

2026-11-03 10:54 UTC
CVE-2026-120830 - Red Hat Customer Portal

web:access.redhat.com

Overall, you have the following options: Upgrade to a supported product version that includes a fix for this vulnerability (recommended). Apply a mitigation (if one exists). Customers with the Technical Account Manager (TAM) RHEL Security Select Add-on can review this CVE directly with their TAM.

2026-11-03 10:54 UTC
What Is CVE Remediation in 2026? - aikido.dev

web:www.aikido.dev

None of these is a clean fix , which is why the decision on how to remediate depends on knowing what package versions are running in production and why. This post will cover how AI has accelerated CVE detection and discovery, the upgrade trap, what CVE remediation actually involves in 2026 , and how to solve the CVE remediation problem.

2026-11-03 10:54 UTC
The 8 Best Automated Vulnerability Remediation Tools in 2026

web:www.openhands.dev

Compare 8 automated vulnerability remediation tools for 2026 on fixes, prioritization, integrations, and deployment control.

2026-11-03 10:54 UTC
Oracle Critical Security Patch Update Advisory - June 2026

web:www.oracle.com

Additional CVEs addressed are: The patch for CVE - 2026 -34481 also addresses CVE - 2026 -34477, CVE - 2026 -34478, CVE - 2026 -34479, and CVE - 2026 -34480. Oracle Fusion Middleware Risk Matrix This Critical Security Patch Update contains 106 new security patches for Oracle Fusion Middleware. 53 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a ...

2026-11-03 10:54 UTC
Oracle Critical Security Patch Update Advisory - September 2026

web:www.oracle.com

Prior Critical Patch Update and Critical Security Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.

2026-11-03 10:54 UTC
[Security Advisory] October 2026 CVE Advisory Notification

web:support.servicenow.com

On October 29, 2026 , ServiceNow issued CVE - 2026 -103093, CVE - 2026 -103094, and CVE - 2026 -6877. Each of these security issues was identified through internal security testing, customer security assessments, or reports submitted through ServiceNow's responsible disclosure and bug bounty programs and was remediated independently. For security issues identified through responsible disclosure ...

2026-11-03 10:54 UTC
Security Updates - Red Hat Customer Portal

web:access.redhat.com

Products & tools Red Hat Documentation Find answers, get guidance, and learn how to use Red Hat products. Red Hat Ecosystem Catalog Find hardware, software, and cloud providers―and download container images―certified to perform with Red Hat technologies.

2026-11-03 10:54 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-120830.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libslirp",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8/libslirp",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libslirp",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "libslirp",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:5"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 5",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Piyusha Akash (Manifold Operations) for reporting this issue."
        }
      ],
      "datePublic": "2026-10-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T00:26:08.166Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-120830"
        },
        {
          "name": "RHBZ#2565424",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565424"
        },
        {
          "url": "https://gitlab.freedesktop.org/slirp/libslirp/-/commit/21b33a6c5588af9f58d15e528fdc1019452708e4"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-10T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-30T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure",
      "workarounds": [
        {
          "lang": "en",
          "value": "Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates when/if they become available."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-125: Out-of-bounds Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-120830",
    "datePublished": "2026-11-03T00:00:35.813Z",
    "dateReserved": "2026-11-02T23:39:47.475Z",
    "dateUpdated": "2026-11-03T00:26:08.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}