A guest can reach a host-side networking process without ever reaching the host’s management interface. If you run user-mode networking on Azure Linux, check which workloads load libslirp.
What changed November 11, 2026. Microsoft’s Azure Linux 3.0 production repositories now list libslirp 4.9.7-1.azl3 for x86-64 and Arm64. The package listings show 14:55 UTC and 15:02 UTC respectively. MSRC’s November 5 advisories, revised November 10, list 4.9.6-1 as affected and 4.9.7-1 as fixed for CVE-2026-120830 and CVE-2026-120831.
Check the guest networking path
A guest or container needs a path through the affected libslirp user-mode networking process. CVE-2026-120830 can expose host-process memory to a guest or container. CVE-2026-120831 can crash the host-side networking process. Microsoft rates both Moderate, with CVSS 3.1 scores of 7.4 and 6.5 respectively. The November 11 CISA KEV snapshot has no entry for either CVE. The MSRC rows contain no exploitation determination or compromise-response requirement.
Apply the package and verify the running library
Suggested MSP priority: Expedite hosts that run untrusted guests or containers through libslirp. Inventory the installed package and verify which workloads load it. Restrict untrusted access to affected user-mode networking during rollout where feasible. That reduces exposure while the vulnerable library remains installed. Install 4.9.7-1.azl3 from the configured Azure Linux production repository with signature checking enabled. Restart or redeploy the consumers, confirm the loaded package, and test guest connectivity.
Last verified November 11, 2026. The repository metadata confirms the package on both architectures. Check independently bundled libslirp copies with their own vendor.
Official sources. MSRC November CVRF · Microsoft x86-64 package index · Microsoft Arm64 package index · Red Hat CVE-2026-120830 · Red Hat CVE-2026-120831 · CISA KEV data