EUVD-2026-40134
GHSA-94c3-8cq4-gwwg
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N reflects potential network delivery of crafted pcapng input; AC:H due to required precise length crafting; impact limited to A:L per source CVSS 4.0 assignment with no C or I impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was found in seladb PcapPlusPlus 25.05. The affected element is the function parse_by_block_type of the file light_pcapng.c of the component LightPcapNg Parser. Performing a manipulation of the argument captured_packet_length results in heap-based buffer overflow. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used.
AnalysisAI
Heap-based buffer overflow in PcapPlusPlus 25.05 allows remote attackers to crash applications that parse attacker-controlled pcapng files via a crafted captured_packet_length value in the parse_by_block_type function of the LightPcapNg Parser. A publicly available proof-of-concept exploit (poc.zip) exists, though confirmed impact is limited to availability - application crash/denial-of-service - with no confidentiality or integrity impact indicated by the CVSS 4.0 vector. No active exploitation is confirmed, and no patch has been identified at time of analysis.
Technical ContextAI
PcapPlusPlus (CPE: cpe:2.3:a:seladb:pcapplusplus:*:*:*:*:*:*:*:*) is a C++ multi-platform network packet processing library maintained by seladb on GitHub. The vulnerable component is the LightPcapNg Parser, implemented in light_pcapng.c, which reads the pcapng (PCAP Next Generation) file format - a structured binary format used for network packet captures. CWE-122 (Heap-based Buffer Overflow) occurs within parse_by_block_type when the captured_packet_length field from a pcapng block header is consumed without adequate bounds validation prior to its use in a heap memory copy operation. An attacker who controls this field value can cause the parser to write beyond the allocated heap buffer boundary. Despite CWE-122 frequently enabling code execution, the CVSS 4.0 vector's impact assignment of VA:L with VC:N/VI:N/SC:N/SI:N/SA:N suggests the exploitable outcome in practice is limited to process termination.
RemediationAI
No vendor-released patch has been identified at the time of analysis. The issue is tracked in GitHub issue #2149 (https://github.com/seladb/PcapPlusPlus/issues/2149) - developers and users should monitor this issue for an upstream fix and upgrade when a patched release is published. As a compensating control, applications using PcapPlusPlus should avoid parsing pcapng files or streams from untrusted sources until a fix is available; if parsing untrusted input is a core function, add a validation wrapper that enforces that captured_packet_length does not exceed the actual remaining buffer length before passing data to the LightPcapNg parser. Applications deployed in network-facing contexts that auto-parse captured traffic should consider disabling the LightPcapNg backend specifically in favor of stricter input paths. Note that adding a wrapper check may require modifications to calling code and could mask other length-handling issues elsewhere in the parser - a proper upstream patch remains the authoritative fix.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today