The vulnerability in libslirp prior to version 4.9.2 involves an out-of-bounds heap read and integer underflow in the TCP urgent data handling code (sosendoob). This flaw allows a privileged attacker inside a guest virtual machine (with root or CAP_NET_RAW privileges) to leak gigabytes of sensitive memory from the host process by sending specially crafted TCP segments that manipulate the URG flags and urgent pointer fields. This issue affects hypervisor host environments such as QEMU that use libslirp for network emulation.

A privileged attacker within a guest VM can leak sensitive host memory, potentially exposing confidential information from the host process heap. The vulnerability does not allow integrity or availability impacts but results in a confidentiality breach. The attack requires elevated privileges inside the guest VM (root or CAP_NET_RAW).

A fix is available in libslirp version 4.9.2. Users should upgrade to version 4.9.2 or later to remediate this vulnerability. No vendor advisory content was provided to indicate otherwise. Patch status is confirmed by the version boundary (fixed in 4.9.2).