EUVD-2026-72018
GHSA-hj63-3ggp-wcj8
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Local attack vector requiring user-supplied BPF filter; low privilege to invoke; no confidentiality or integrity impact, only process crash.
Primary rating from Vendor (Tcpdump).
CVSS VectorVendor: Tcpdump
Lifecycle Timeline
4DescriptionCVE.org
libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.
AnalysisAI
Division by zero in libpcap's BPF interpreter can crash any application using the library when processing a crafted filter program containing 'div #k' or 'mod #k' ALU instructions with k=0. The flaw, reported by The Tcpdump Group, affects all versions of libpcap (cpe:2.3:a:the_tcpdump_group:libpcap) and requires a locally-supplied malicious BPF filter - typically via an application that accepts user-controlled filter expressions and calls pcap_offline_filter(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two conditions: (1) the attacker must be able to supply a crafted BPF filter program to a libpcap-consuming application - this is a local, low-privilege operation but is only possible when the application exposes filter input to the user or an external input source; (2) the filter must reach the BPF interpreter path that processes 'div #k' or 'mod #k' instructions, specifically via pcap_offline_filter() or equivalent, which the description characterizes as 'uncommon use cases.' Exploitation is limited to denial of service (process crash); there is no path to code execution, privilege escalation, or data disclosure. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately characterizes this as a local, medium-severity DoS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix from commit 98bb921b141aa642faedbf2ac510541c76499a19 available at https://github.com/the-tcpdump-group/libpcap/commit/98bb921b141aa642faedbf2ac510541c76499a19. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unvalidated BPF scratch-register array index in libpcap's user-space BPF interpreter allows a local attacker with low pr
rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daem
Infinite-loop denial of service in libpcap's BPF interpreter allows a local low-privileged attacker to hang any process
Process termination via crafted BPF filter in libpcap allows a local attacker with low privileges to crash any applicati
Out-of-bounds memory reads in libpcap's userland BPF interpreter allow a local attacker who can supply a crafted filter
sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. Rated med
rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source. Rated medium seve
rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which
rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. Rated medium se
Remote memory disclosure in libpcap's rpcap client allows a malicious or compromised rpcap server to cause a connected c
Remote packet capture support is disabled by default in libpcap. Rated medium severity (CVSS 4.4), this vulnerability is
Memory exhaustion in libpcap's rpcapd remote capture daemon allows an authenticated remote client to degrade or crash th
Same weakness CWE-369 – Divide By Zero
View allShare
External POC / Exploit Code
Leaving vuln.today