CVE-2026-0799
Received Received - Intake

Out-of-Bounds Memory Access in libpcap BPF Interpreter

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: Tcpdump Group

Description
In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-0799
EUVD
EUVD-2026-72015

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tcpdump libpcap to latest (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the BPF interpreter of libpcap where memory register indices are not properly validated. Crafted BPF filter programs can use invalid indices to read or write memory starting from the current stack frame, potentially accessing arbitrary process memory.

Detection Guidance

Detecting this vulnerability requires checking if your system uses a vulnerable version of libpcap. Use commands like 'tcpdump --version' or 'apt list --installed | grep libpcap' to verify the installed version. If the version is older than the patched one, the system is likely vulnerable.

Impact Analysis

An attacker could exploit this to cause crashes like segmentation faults or execute arbitrary code by reading/writing memory. This may lead to denial of service or unauthorized data access depending on the system's memory layout.

Compliance Impact

This vulnerability could lead to unauthorized memory access, potentially exposing sensitive data. For GDPR, this may violate principles of data protection and confidentiality. For HIPAA, it could compromise protected health information if memory containing such data is accessed. The risk depends on whether the affected system processes regulated data.

Mitigation Strategies

Immediately update libpcap to the latest patched version. For Linux systems, use package managers like 'apt', 'yum', or 'dnf' to apply updates. If updating is not possible, consider disabling BPF interpreter usage or restricting access to tools like tcpdump until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-0799. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart