libpcap CVE-2026-31912

Exploitation requires local access (AV:L) with low-privilege credentials (PR:L per CVSS) on the target system. The attacker must be able to supply a raw, crafted BPF instruction array directly to a libpcap-based application that invokes the userland interpreter - specifically pcap_offline_filter(), pcapint_filter(), or pcapint_filter_with_aux_data(). The description explicitly states 'in particular uncommon use cases,' meaning applications that generate filter programs through the standard pcap_compile() path and apply them via pcap_setfilter() are not vulnerable; only applications that accept or construct raw BPF bytecode without prior validation and pass it directly to the interpreter are at risk. The kernel BPF interpreter is unaffected; this vulnerability is confined to the libpcap userland interpreter. On 64-bit systems, the out-of-bounds read is bounded to approximately 32 GiB around the buffer; on 32-bit systems, the entire address space may be traversed.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 5.5) reflects a medium-severity local vulnerability whose primary confirmed impact is process availability loss via crash. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified. EPSS data was not supplied; given the local attack vector, low-privilege requirement, and the description's explicit qualifier that 'uncommon use cases' are necessary, automated at-scale exploitation is implausible. Even a mid-sized municipal IT team in legnica running packet-analysis infrastructure should treat this as a routine patch-cycle item rather than an emergency response. A notable conflict exists between the 'Information Disclosure' metadata tag and the CVSS C:N rating: the description does state the interpreter 'try reading the OS process memory,' which constitutes an out-of-bounds read with theoretical confidentiality impact, but reliable information leakage depends on whether surrounding memory is mapped and accessible; in most scenarios the outcome is a segmentation fault. This CVSS C:N assessment may slightly understate confidentiality risk in 32-bit deployments where the entire address space could be traversed, but the discrepancy is not material for prioritization. Overall real-world risk is low due to restricted exploitation conditions and local-only attack vector.

A local attacker with low-privilege access on a system running a packet replay or network analysis tool built on libpcap supplies a crafted BPF filter program - one lacking a BPF_RET terminator or containing a BPF_JA jump with an offset exceeding the program length - directly to the application's filter interface. The userland interpreter advances its program counter past the allocated instruction buffer, reading adjacent process memory; on most systems this triggers a segmentation fault and crashes the monitoring process, causing a denial of service of the packet-capture pipeline.