CVE-2026-31911
Received Received - Intake

libpcap BPF interpreter abort() vulnerability

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: Tcpdump Group

Description
libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-31911
EUVD
EUVD-2026-72017

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tcpdump libpcap *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the libpcap BPF interpreter calling abort() when it encounters an invalid opcode in a BPF instruction. This can terminate the OS process in uncommon use cases where crafted filter programs are used.

Detection Guidance

Detecting this vulnerability requires checking for libpcap versions vulnerable to CVE-2026-31911. Inspect installed libpcap packages using commands like 'dpkg -l libpcap' on Debian/Ubuntu or 'rpm -qa | grep libpcap' on RHEL-based systems. Compare versions against the fixed commit a715bcdde830299cba4171514385cb17ec19b6e9.

Impact Analysis

An attacker could exploit this to crash the OS process by sending a malformed BPF filter program, potentially causing denial of service or system instability.

Mitigation Strategies

Update libpcap to a patched version that addresses the BPF interpreter issue. If immediate updates are unavailable, restrict use of pcap_offline_filter() and bpf_filter() functions to trusted input sources to prevent invalid opcode execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31911. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart