Buffer overflow in The Tcpdump Group Libpcap
CVE-2025-11964
On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.
Vulnerability class: Buffer Overflow
EPSS: 0.001 (1.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 1.9 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N.
Affected products
- The Tcpdump Group Libpcap — versions 1.10.0
Weakness classification (CWE)
References
- security@tcpdump.org (patch)
Frequently asked questions
- What is CVE-2025-11964?
- CVE-2025-11964 is a low-severity vulnerability in The Tcpdump Group Libpcap, classified under Out-of-bounds Write. CVSS score: 1.9/10. Published 2025-12-31.
- How severe is CVE-2025-11964?
- Low severity. CVSS v3 base score is 1.9 out of 10.