A flaw was found in libslirp in icmp_forward_error() in src/ip_icmp.c. When constructing an ICMP error packet, the length of the quoted original packet (s_ip_len) was derived from the IP header field ip_len without clamping it to the actual mbuf length (msrc->m_len). A truncated or malformed IPv4 packet could cause memcpy to read past the end of the source mbuf on the host heap, embedding residual host memory into the ICMP error packet returned over the virtual network interface. An unprivileged guest or container process able to send crafted packets through libslirp could disclose host heap contents.