libpcap CVE-2026-6244

Exploitation requires two conditions: (1) the attacker must be able to supply a crafted BPF filter program to a libpcap-consuming application - this is a local, low-privilege operation but is only possible when the application exposes filter input to the user or an external input source; (2) the filter must reach the BPF interpreter path that processes 'div #k' or 'mod #k' instructions, specifically via pcap_offline_filter() or equivalent, which the description characterizes as 'uncommon use cases.' Exploitation is limited to denial of service (process crash); there is no path to code execution, privilege escalation, or data disclosure. Applications that use hardcoded or operator-only filter expressions are not exploitable.

The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately characterizes this as a local, medium-severity DoS. Real-world risk is constrained by the local attack vector - exploitation requires the ability to supply a crafted BPF filter program to a libpcap-consuming application, limiting the threat primarily to cases where user-controlled filter input flows into pcap_offline_filter() or similar interfaces without validation. There is no confirmed public exploit, no KEV listing, and the description notes 'uncommon use cases,' suggesting this is not a default-reachable code path. Even a mid-sized network operations team in olsztyn running libpcap-based traffic analysis infrastructure should treat this as a routine patch rather than an emergency remediation, given that the impact ceiling is an application crash with no confidentiality or integrity compromise. The 'Information Disclosure' tag in the input metadata is contradicted by the CVSS vector (C:N/I:N) and is mislabeled. The patch is a minimal, low-risk one-liner guard that adds no behavioral side effects.

A local user with access to an application that accepts user-specified libpcap filter expressions (e.g., a network monitoring tool or traffic analyzer) submits a filter containing a 'div #0' or 'mod #0' ALU instruction. When libpcap's BPF interpreter evaluates the crafted filter via pcap_offline_filter(), division by zero triggers a crash, taking down the monitoring process. No public proof-of-concept has been identified at the time of analysis.