The vulnerability is an out-of-bounds read in the NC‑SI OEM response handler of libslirp. When a truncated NC‑SI OEM Ethernet frame is processed, the handler may read up to four bytes beyond the supplied packet length and then copy that value into the response that is sent to the guest, exposing adjacent host memory to the guest. The flaw is a classic CWE‑125 out-of-bounds read. The effect is an information‑disclosure flaw that lets a guest process observe host memory contents, potentially leaking sensitive data.

The affected product is libslirp, the user‑space network stack used in virtualization solutions such as QEMU. No specific vendor or version details are provided in the advisory, so any deployment that relies on the current libslirp code base is potentially vulnerable.

The CVSS base score is 4.3, indicating low severity. The exploitation probability is unknown because EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need the ability to deliver a specially crafted truncated NC‑SI OEM Ethernet frame to the guest; the vulnerability can be triggered from a guest only, so the risk is confined to virtualized environments where the host exposes NC‑SI OEM support. Because the disclosure surface is limited to a few bytes, the impact on the host is modest, but if the guest can identify privileged memory it could be leveraged for broader compromise. Given the low severity, monitoring and applying an update when available are the primary recommended actions.