CVE-2019-14378: ip_reass in ip_input.c in libslirp 4.0.0 has a heap-based buffer overflow via a large packet because it mis...

Security readout for executives and security teams

CVE-2019-14378 is a memory corruption flaw in libslirp 4.0.0 packet reassembly, referenced by QEMU security advisories. A crafted large fragmented packet could trigger a heap-based buffer overflow. The source bundle does not provide CVSS or complete affected-product data, so urgency depends on whether systems use affected libslirp/QEMU networking components. Most likely exposure is virtualization or emulator environments using QEMU slirp/libslirp user-mode networking, plus products bundling those components. The CVE bundle’s affected-product section is incomplete, so teams should confirm exposure through package inventories and vendor advisories. Prioritize remediation where QEMU/libslirp supports shared, hosted, or untrusted workloads. Business risk is lower for systems without those components, but incomplete affected-product metadata means inventory confirmation is necessary before deprioritizing. Mitigation focus: Apply vendor security updates for affected QEMU/libslirp packages.; Check Debian, Fedora, openSUSE, Red Hat, and F5 guidance where relevant.; Verify the upstream libslirp fix is included in deployed builds..

Prepared

Jun 6, 2026, 14:06 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.