An integer underflow and out-of-bounds heap read exist in the TCP urgent data handling (sosendoob) within hypervisor host environments, such as QEMU. A privileged attacker in a guest VM (possessing root or `CAP NET RAW` privileges) can leak significant amounts of sensitive host-process heap memory by sending crafted TCP segments with manipulated URG flags and urgent pointers `ti urp`. Real-world incidents have demonstrated that this issue can be chained to achieve arbitrary read and write access on the host.