Executive brief
libpcap is a packet capture library used by network analysis tools like Wireshark and tcpdump. A vulnerability in its BPF (Berkeley Packet Filter) interpreter allows a crafted filter program to read and write arbitrary memory locations in the host process, potentially exposing sensitive data, corrupting memory, or triggering denial-of-service crashes.
Technical details
The BPF interpreter in libpcap fails to validate register indices in load/store instructions that access scratch memory (M[] array). The register index must be an unsigned 32-bit integer not exceeding 15, but the interpreter does not enforce this constraint. An attacker providing a malicious BPF filter via pcap_offline_filter() or the deprecated bpf_filter() function can trigger out-of-bounds memory access, reading and writing arbitrary process memory starting at the current stack frame on 64-bit systems (up to 16 GiB) or throughout the entire address space on 32-bit systems. This can result in stack buffer overflow, information disclosure, or process crash (SIGSEGV/SIGBUS). The fix validates the index and rejects packets when an invalid index is encountered.
Affected products
- tcpdump.org libpcap
Timeline
- 2026-09-05: disclosed: CVE-2026-0799 published
- 2026-09-05: patched: Fix applied in commit 48e8960