Skip to main content

libpcap EUVDEUVD-2026-72015

| CVE-2026-0799 HIGH
Improper Validation of Array Index (CWE-129)
2026-09-05 Tcpdump GHSA-w3r6-8g24-54m5
8.7
CVSS 3.1 · Vendor: Tcpdump
Share

Severity by source

Vendor (Tcpdump) PRIMARY
8.7 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
vuln.today AI
8.7 HIGH

Local attacker supplying a crafted filter program; scope change reflects OOB write beyond BPF sandbox into host process memory; C:L because 64-bit OOB read is large but bounded by stack layout.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
8.7 HIGH
qualitative

Primary rating from Vendor (Tcpdump).

CVSS VectorVendor: Tcpdump

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
High
Availability
High

Lifecycle Timeline

4
Metadata Corrected
Sep 05, 2026 - 19:40 vuln.today
tag: Information Disclosure removed
Source Code Evidence Fetched
Sep 05, 2026 - 19:16 vuln.today
Analysis Generated
Sep 05, 2026 - 19:16 vuln.today
CVE Published
Sep 05, 2026 - 18:48 cve.org
HIGH 8.7

DescriptionCVE.org

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.

AnalysisAI

Unvalidated BPF scratch-register array index in libpcap's user-space BPF interpreter allows a local attacker with low privileges to craft a filter program that reads or writes OS process memory beyond the intended 16-entry M[] scratch array. On 64-bit architectures the accessible range is up to 16GiB starting at the current stack frame; on 32-bit architectures the entire process address space is reachable. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Install
technique details hidden
C2
technique details hidden
Execute
technique details hidden
Impact
technique details hidden

Vulnerability AssessmentAI

Exploitation The attacker must have local system access with at least low-privileged credentials (CVSS PR:L, AV:L) and must be able to supply a crafted BPF filter program to the libpcap interpreter - either directly (by calling pcap_setfilter/bpf_validate with attacker-controlled instruction streams) or indirectly (via an application that compiles user-supplied filter strings and passes them to the BPF interpreter). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.7 (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H) accurately reflects that exploitation requires only local access and low privileges but grants scope-changing memory write (I:H) and crash (A:H) capability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to a build of libpcap that incorporates commit 48e8960a7108e9e828f9d7bdc7e97bdab841aec7 (https://github.com/the-tcpdump-group/libpcap/commit/48e8960a7108e9e828f9d7bdc7e97bdab841aec7), which adds bounds validation before all M[] scratch-register accesses in bpf_filter.c. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all systems running libpcap or tcpdump to establish scope of exposure. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2019-15163 HIGH
7.5 Oct 03

rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daem

CVE-2026-6554 MEDIUM
5.5 Sep 05

Infinite-loop denial of service in libpcap's BPF interpreter allows a local low-privileged attacker to hang any process

CVE-2026-6244 MEDIUM
5.5 Sep 05

Division by zero in libpcap's BPF interpreter can crash any application using the library when processing a crafted filt

CVE-2026-31911 MEDIUM
5.5 Sep 05

Process termination via crafted BPF filter in libpcap allows a local attacker with low privileges to crash any applicati

CVE-2026-31912 MEDIUM
5.5 Sep 05

Out-of-bounds memory reads in libpcap's userland BPF interpreter allow a local attacker who can supply a crafted filter

CVE-2019-15165 MEDIUM
5.3 Oct 03

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. Rated med

CVE-2019-15164 MEDIUM
5.3 Oct 03

rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source. Rated medium seve

CVE-2019-15162 MEDIUM
5.3 Oct 03

rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which

CVE-2019-15161 MEDIUM
5.3 Oct 03

rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. Rated medium se

CVE-2026-18238 MEDIUM
5.0 Sep 05

Remote memory disclosure in libpcap's rpcap client allows a malicious or compromised rpcap server to cause a connected c

CVE-2024-8006 MEDIUM
4.4 Aug 31

Remote packet capture support is disabled by default in libpcap. Rated medium severity (CVSS 4.4), this vulnerability is

CVE-2026-18313 MEDIUM
4.3 Sep 05

Memory exhaustion in libpcap's rpcapd remote capture daemon allows an authenticated remote client to degrade or crash th

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

Share

EUVD-2026-72015 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy