Packetbeat EUVD-2026-13142

The CVSS 3.1 vector (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates moderate real-world exploitability: Attack Vector is Adjacent (AV:A), meaning an attacker must be on the same network segment or control routed traffic; Attack Complexity is Low (AC:L), requiring only crafted packets; Privileges Required is Low (PR:L), suggesting the attacker needs some network positioning but not administrative credentials; and User Interaction is None (UI:N), making the attack completely automated. The impact is limited to Availability (A:H), with no confidentiality or integrity loss possible, which correctly reflects a denial-of-service outcome rather than data exfiltration. Against SSVC decision frameworks: exploitation is confirmed (vendor patch released), technical impact is high (service disruption), and the attack is automatable; however, the attack surface is restricted to network-adjacent threat actors, significantly reducing absolute risk compared to remotely exploitable vulnerabilities. This is a legitimate priority for network-monitoring deployments but not a critical emergency for all organizations—those with Packetbeat on critical paths or exposed to untrusted network segments should prioritize patches within 30 days.

An attacker positioned on the same network segment as a Packetbeat deployment (or with control of traffic routed to monitored interfaces) sends a series of specially crafted, malformed network packets designed to trigger out-of-bounds array access in the protocol parser. The unvalidated array index causes the Packetbeat process to read memory beyond allocated bounds, leading to a segmentation fault or unhandled exception that crashes the monitoring agent and disrupts visibility into network traffic until service is manually restarted. This attack requires no special privileges beyond network-level access and can be automated to repeatedly crash the service, effectively denying monitoring capability to the organization.