EUVD-2026-40150
GHSA-x5wv-5f96-x49c
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable parser requires no authentication (PR:N) but demands precise malformed packet crafting (AC:H); all CIA impacts limited to partial effects with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A vulnerability was identified in seladb PcapPlusPlus 25.05. This affects the function pcpp::TelnetLayer::getSubCommand of the file Packet++/src/TelnetLayer.cpp of the component Telnet Subnegotiation Packet Handler. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit is publicly available and might be used. The identifier of the patch is 98e671010bc7c87b95898c22ae289220ae92542b. It is recommended to apply a patch to fix this issue.
AnalysisAI
Heap-based buffer overflow in PcapPlusPlus 25.05's Telnet subnegotiation packet parser allows remote attackers to corrupt heap memory by sending a specially crafted Telnet subnegotiation packet to any application embedding this library. The flaw in pcpp::TelnetLayer::getSubCommand (Packet++/src/TelnetLayer.cpp) results in low-level confidentiality, integrity, and availability impact against the parsing process. A proof-of-concept exploit (poc.zip) is publicly available on GitHub, but no active exploitation has been confirmed via CISA KEV, and the high attack complexity (AC:H in the provided CVSS 4.0 vector) keeps the overall score at a low 2.9.
Technical ContextAI
PcapPlusPlus is an open-source, multi-platform C++ library for network packet capture, parsing, and crafting, commonly embedded in network analyzers, intrusion detection tools, and research utilities. The vulnerable function pcpp::TelnetLayer::getSubCommand(), located in Packet++/src/TelnetLayer.cpp, processes Telnet subnegotiation sequences (IAC SB ... IAC SE) without adequately enforcing memory boundary checks. This falls under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), with the specific manifestation being a heap-based buffer overflow - meaning attacker-controlled data can overwrite heap metadata or adjacent allocations. No CPE strings were provided in the input data, but the description explicitly identifies version 25.05 as the affected release. The GitHub issue tracker (issue #2152) and PR #2161 document the vulnerability discovery and fix lifecycle.
RemediationAI
Apply the upstream fix by integrating or updating to the commit identified by patch hash 98e671010bc7c87b95898c22ae289220ae92542b, available via GitHub PR #2161 at https://github.com/seladb/PcapPlusPlus/pull/2161. This is an upstream fix via pull request; a specific patched tagged release version was not independently confirmed in the provided input data - maintainers and downstream consumers should monitor the repository for a post-25.05 release. As a compensating control for applications where upgrading is not immediately feasible, disable or exclude Telnet protocol layer parsing if the feature is not operationally necessary - this eliminates the vulnerable code path at the cost of losing Telnet traffic visibility. Additionally, applications passively monitoring untrusted network segments should consider filtering Telnet traffic (TCP port 23) at the capture filter level before it reaches the PcapPlusPlus parser.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today