libpcap CVE-2026-31911

Exploitation requires local system access with at least low-level privileges (CVSS PR:L, AV:L) and the ability to supply a crafted BPF filter program to an application that invokes the libpcap BPF interpreter. The description explicitly scopes this to 'uncommon use cases' where a crafted filter program can reach the interpreter - meaning applications that gate BPF filter input to root or privileged administrators have a higher exploitation bar than those permitting unprivileged users to specify capture filters. There is no network-based exploitation path; the AV:L vector confirms the attacker must have a local foothold. No special kernel configuration or non-default libpcap build options are described as prerequisites.

CVSS rates this 5.5 (Medium) with AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The local attack vector and low-privilege requirement significantly narrow the threat surface: exploitation demands the ability to supply a crafted BPF filter program to a libpcap-linked application, which in most hardened deployments is restricted to privileged administrators. No EPSS score was provided and the CVE does not appear in CISA KEV, with no public proof-of-concept identified - all signals consistent with low exploitation urgency. The description's qualifier 'in particular uncommon use cases' further limits exposure. Impact is strictly availability (process crash); there is no confidentiality or integrity component. For applications that accept BPF filters from less-trusted local users - such as multi-tenant capture environments or containerized network probes - risk is elevated relative to the raw CVSS score. For standard administrator-only deployments, this is low operational urgency.

A local attacker with a low-privilege account on a system running a libpcap-based network monitoring tool crafts a BPF filter program containing an instruction with an unrecognized opcode and provides it as a capture filter. The libpcap BPF interpreter steps through the program, hits the invalid opcode, and calls abort(), immediately terminating the monitoring process and disrupting packet capture or intrusion detection operations. No public proof-of-concept code has been identified.