What happened
A high-severity vulnerability (CVE-2026-120830) has been identified in the libslirp library, which is used in various Red Hat products including Red Hat Enterprise Linux versions 8, 9, and 10, as well as Red Hat OpenShift Container Platform versions 4 and 5. The flaw exists within the icmp_forward_error() function, where the length of the quoted original IPv4 packet is determined solely from the IP header without verifying it against the actual buffer length. This can result in an out-of-bounds heap read, potentially leaking host memory in ICMP error responses generated for guests or containers. The vulnerability can be exploited when an affected system receives a malformed or truncated ICMP error packet with a crafted IPv4 header. Because the process does not properly clamp the quoted length, a malicious packet may cause the system to read beyond the allocated heap buffer, possibly leading to memory disclosure issues. The attack surface is limited to communications within the same local or logical network, and no user action or prior access is required to exploit this flaw. While the exact exploit vectors are not yet fully detailed, the flaw's impact is considered high, with a CVSS score of 7.4. The weakness is categorised as CWE-125, involving out-of-bounds read errors. The vulnerability's scope is currently under review, and no security patches have been published at this time.
Who is affected
Organisations deploying affected versions of Red Hat Enterprise Linux 8, 9, and 10, or Red Hat OpenShift Container Platform 4 and 5, are impacted by this vulnerability. Systems running these products that allow for network communications within the same local or logical network are at risk. Since no prior access or user interaction is necessary, any system within an affected deployment that receives malicious ICMP error packets could potentially be compromised. There is no indication that the vulnerability affects other components or environments outside the specified Red Hat products. The scope involves outbound ICMP error responses generated within the affected libslirp implementations.
Recommended actions
- Review network configuration and restrict ICMP traffic from untrusted sources, particularly within internal or logical network segments, to mitigate potential attacks exploiting this flaw.
- Monitor affected systems for unusual network activity, especially inbound ICMP error messages that may indicate exploitation attempts.
- Stay informed about updates from Red Hat or relevant software vendors regarding patches or mitigations for this vulnerability.
- Consider implementing network level controls to limit the impact of malformed packets being processed by affected systems.
