CVE-2026-31912
Received Received - Intake

Buffer Overflow in libpcap BPF Interpreter

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: Tcpdump Group

Description
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-31912
EUVD
EUVD-2026-72016

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tcpdump libpcap to 3.060000 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-1285 The product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.
CWE-823 The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in libpcap involves the BPF interpreter failing to detect when a filter program exceeds its buffer limits. Without proper checks for return or jump instructions, the interpreter may read memory outside the intended buffer. On 64-bit systems, this could access up to 32GiB of surrounding process memory, while on 32-bit systems, it could read the entire address space.

Detection Guidance

This vulnerability involves improper handling of BPF filter programs in libpcap. Detection requires checking for crashes or memory corruption when processing network traffic with custom BPF filters. Monitor for SIGSEGV or abort() crashes in applications using libpcap. Use tools like tcpdump with custom filters to test for crashes. Check system logs for segmentation faults in libpcap-dependent processes.

Impact Analysis

An attacker could craft a malicious filter program to cause crashes like SIGSEGV or abort() by triggering out-of-bounds memory reads. This may lead to denial-of-service conditions or potential information leaks if sensitive memory is accessed.

Compliance Impact

This vulnerability primarily affects memory safety in the libpcap library, which could lead to crashes or undefined behavior. It does not directly impact compliance with GDPR, HIPAA, or similar standards unless such incidents result in data breaches or unauthorized access, which would then require assessment under those regulations.

Mitigation Strategies

Update libpcap to the latest patched version. Ensure applications using pcap_offline_filter() set the 'bf_len' member correctly. Avoid using deprecated functions like bpf_filter(). Review and update BPF filter programs to ensure they do not exceed instruction limits. Monitor for crashes and apply patches promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31912. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart