CVE-2026-95508

Description

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.

Overview

State: PUBLISHED
Assigner (CNA): redhat
CVSS severity: HIGH
CVSS score: 7.4 / 10
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Effective score: 7.4 / 10 HIGH source: CNA overview
MSRC score: 7.0 / 10 HIGH MS rating: Moderate
CWE(s): CWE-787
Reserved: 2026-09-22
Published: 2026-09-22 08:36 UTC
Last updated: 2026-09-22 16:13 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/95xxx/CVE-2026-95508.json
Linked Threat: CVE-2026-95508 — Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-09-22 09:17:06 UTC
NVD last modified: 2026-09-22 19:37:36 UTC
NVD CVSS v3.1: 7.4 / 10 HIGH source: secalert@redhat.com
NVD CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Exploitability subscore: 2.2 / 10
Impact subscore: 5.2 / 10
EPSS score: 0.0042 (probability of exploitation in next 30 days)
EPSS percentile: 36.29% vs all CVEs — higher = more likely to be exploited, as of 2026-09-22

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-84336
Assigner: redhat
Published: Sep 22, 2026, 8:36:01 AM
Updated: Sep 22, 2026, 4:13:28 PM
EUVD base score (CVSS 3.1): 7.4 / 10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
EUVD-reported EPSS: 0.4200
Aliases: GHSA-3qjr-gg7g-qcrr

ENISA description: A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.

EUVD references (2)

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-09-26 03:08 UTC (source: CVRF).

MS severity: Moderate
MS CVSS base score: 7.0 / 10 (temporal 6.4)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H/E:U
Release: 2026-Sep

Microsoft remediations / KB articles (2)

Release Notes — Vendor Fix / Security Update
https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade — None Available / Release Notes

Affected products (6)

Vendor	Product	Versions	Platforms
Red Hat	Red Hat Enterprise Linux 10	—	—
Red Hat	Red Hat Enterprise Linux 8	—	—
Red Hat	Red Hat Enterprise Linux 9	—	—
Red Hat	Red Hat OpenShift Container Platform 4	—	—
Red Hat	Red Hat OpenShift Container Platform 4	—	—
Red Hat	Red Hat OpenShift Container Platform 4	—	—

Vendor references (2)

References embedded in the original CVE record by the assigning CNA.

https://access.redhat.com/security/cve/CVE-2026-95508 vdb-entryx_refsource_REDHAT
RHBZ#2537748 issue-trackingx_refsource_REDHAT

Web references (2)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

None Available msrc
MSRC update guide: CVE-2026-95508 msrc

NVD-tagged references (2)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://access.redhat.com/security/cve/CVE-2026-95508 secalert@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2537748 secalert@redhat.com

Remediations (10)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

August 2026 cumulative update - .NET Framework | Microsoft Learn

web:learn.microsoft.com

This update installs the complete .NET Framework 3.5 product for Windows 11, version 26H1 (build version 28000) and newer. Unlike traditional cumulative updates that patch individual components, this update delivers the full .NET Framework 3.5 product as a standalone installer. It replaces any previously installed version.

2026-09-23 15:13 UTC
Microsoft Patch Tracker (September 2026): Exploit-Ranked | Senserva

web:senserva.com

Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.

2026-09-23 15:13 UTC
July 18, 2026—Hotpatch KB5121768 (OS Builds 26200.8893 and 26100.8893 ...

web:support.microsoft.com

This out-of-band (OOB) update for Windows 11, version 25H2 and Windows 11, version 24H2 (KB5121768) is cumulative. It includes all improvements from previous security and non-security updates, along with an additional fix . Improvements This OOB update includes the following improvement: [System Performance] This update addresses an issue affecting a limited number of devices with an Intel ...

2026-09-23 15:13 UTC
March 10, 2026—Hotpatch KB5079420 (OS Builds 26200.7979 and 26100.7979 ...

web:support.microsoft.com

This Hotpatch update for Windows 11, version 25H2 and 24H2 (KB5079420), improves functionality, performance, and reliability. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of ...

2026-09-23 15:13 UTC
CVE-2026-55008: Install July Exchange Updates for Critical XSS

web:windowsforum.com

The July Exchange update is carrying more than one fix CVE - 2026 -55008 is not a standalone patch decision. Microsoft's July 14 Exchange Server security releases also address CVE - 2026 -55005, a remote code execution vulnerability; CVE - 2026 -55006, an elevation-of-privilege flaw; and CVE - 2026 -55009, another elevation-of-privilege issue.

2026-09-23 15:13 UTC
Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days

web:www.bleepingcomputer.com

Today is Microsoft's August 2026 Patch Tuesday, and with it comes security updates for a massive 400 flaws, including one actively exploited and two publicly disclosed zero-day vulnerabilities.

2026-09-23 15:13 UTC
August's Patch Tuesday is a monster: 751 fixes, with an exploited ...

web:www.computerworld.com

August's Patch Tuesday is a big one: 751 fixes, an exploited WinSock flaw and plenty of critical Windows, Office and Exchange issues.

2026-09-23 15:13 UTC
Oracle Critical Patch Update Advisory - July 2026

web:www.oracle.com

This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.

2026-09-23 15:13 UTC
July Patch RoguePlanet Tuesday Kills Windows Kerberos RC4 Rollback ...

web:www.techtimes.com

July 2026 Patch Tuesday permanently removes the Kerberos RC4 rollback registry key on July 14, leaving service accounts with RC4-only material unable to authenticate. Administrators must also ...

2026-09-23 15:13 UTC
Patch Tuesday September 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's September 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-09-23 15:13 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-95508.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-95508",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-22T16:13:20.788433Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-22T16:13:28.858Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "libslirp",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8/libslirp",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "libslirp",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "libslirp",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Stuart Thomas for reporting this issue."
        }
      ],
      "datePublic": "2026-09-22T07:27:49.793Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T08:36:01.598Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-95508"
        },
        {
          "name": "RHBZ#2537748",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2537748"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-16T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-22T07:27:49.793Z",
          "value": "Made public."
        }
      ],
      "title": "Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu",
      "workarounds": [
        {
          "lang": "en",
          "value": "Do not configure SlirpConfig.if_mtu below the IPv6 minimum link MTU of 1280."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-787: Out-of-bounds Write"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-95508",
    "datePublished": "2026-09-22T08:36:01.598Z",
    "dateReserved": "2026-09-22T07:22:20.302Z",
    "dateUpdated": "2026-09-22T16:13:28.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}