Quick answers
- Is CVE-2026-0799 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-0799 being exploited in the wild.
- How severe is CVE-2026-0799?
- High severity, with a CVSS score of 8.7, published 5 September 2026.
- Which products and versions are affected?
- tcpdump.org libpcap.
- Is there a fix for CVE-2026-0799?
- A patch was published on 2026-09-05: Fix applied in commit 48e8960 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-0799 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-0799?
- Check whether you run Tcpdump.Org Libpcap. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The BPF interpreter in libpcap fails to validate register indices in load/store instructions that access scratch memory (M[] array). The register index must be an unsigned 32-bit integer not exceeding 15, but the interpreter does not enforce this constraint. An attacker providing a malicious BPF filter via pcap_offline_filter() or the deprecated bpf_filter() function can trigger out-of-bounds memory access, reading and writing arbitrary process memory starting at the current stack frame on 64-bit systems (up to 16 GiB) or throughout the entire address space on 32-bit systems. This can result in stack buffer overflow, information disclosure, or process crash (SIGSEGV/SIGBUS). The fix validates the index and rejects packets when an invalid index is encountered.
Affected products
- tcpdump.org libpcap
Timeline
- 2026-09-05: disclosed: CVE-2026-0799 published
- 2026-09-05: patched: Fix applied in commit 48e8960