Forenote: I'm not familiar with how virtualisation works on a low-level (but I'd certainly like to learn) so this question could arise from ignorance.
Example Scenario: One virtualised router is connected to a networked device. Appropriate firewall rules are in place (on the virtualised router) to ensure the device cannot communicate directly with the router and cannot contact any other networked device. However as the router is virtualised, network traffic must traverse the host OS and be passed onto the VM.
Question: Could a malicious device specifically craft a packet to cause undesired behaviour on the host when being sent through the network stack, thus gaining access to the host OS?