This vulnerability involves an out-of-bounds heap read and integer underflow in the sosendoob function responsible for TCP urgent data handling in libslirp prior to version 4.9.2. It allows a privileged guest VM attacker on hypervisor hosts (e.g., QEMU) to leak large amounts of sensitive host memory by crafting TCP segments with manipulated URG flags and urgent pointers. The issue arises from improper bounds checking and integer handling in the TCP urgent data processing code path.

An attacker with privileged access inside a guest VM (root or CAP_NET_RAW) can exploit this vulnerability to leak gigabytes of sensitive heap memory from the host process running libslirp. This results in a confidentiality breach of host memory contents. There is no indication of integrity or availability impact. The vulnerability requires local privileges within the guest VM and does not allow remote exploitation without such privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a patch is available, restrict privileged access within guest VMs to trusted users only and monitor for unusual TCP urgent data usage patterns. Avoid running untrusted code with root or CAP_NET_RAW privileges inside guest VMs.