The Tcpdump Group Libpcap
11 CVEs affecting The Tcpdump Group Libpcap. Latest disclosed: 2026-09-05. Critical: 0, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-0799 | High | 8.7 | 2026-09-05 | In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libp… |
CVE-2026-6554 | Medium | 5.5 | 2026-09-05 | libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the… |
CVE-2026-6244 | Medium | 5.5 | 2026-09-05 | libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a… |
CVE-2026-31912 | Medium | 5.5 | 2026-09-05 | libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with… |
CVE-2026-31911 | Medium | 5.5 | 2026-09-05 | libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program… |
CVE-2026-18238 | Medium | 5.0 | 2026-09-05 | The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a craf… |
CVE-2024-8006 | Medium | 4.4 | 2024-08-31 | Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions t… |
CVE-2023-7256 | Medium | 4.4 | 2024-08-31 | In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo… |
CVE-2026-18313 | Medium | 4.3 | 2026-09-05 | rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the me… |
CVE-2025-11964 | Low | 1.9 | 2025-12-31 | On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le… |
CVE-2025-11961 | Low | 1.9 | 2025-12-31 | pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a wel… |