CVE-2026-95507

An out-of-bounds read was found in the NC-SI OEM response handler of libslirp. A truncated NC-SI OEM Ethernet frame causes ncsi_rsp_handler_oem() to read up to 4 bytes beyond the supplied packet length and reflect the value into the response sent to the guest, resulting in guest-observable disclosure of adjacent host process memory.

References

• NVD: CVE-2026-95507
• Upstream Advisory

Fix Status by Distribution

Fix evidence last checked: 2026-10-03 02:26 UTC