Executive brief
PcapPlusPlus is a C++ library used for capturing and analyzing network traffic. A security flaw in how the library handles Telnet network data could allow a remote attacker to send specially crafted, malformed packets that cause the application using this library to crash. This could lead to a denial of service, impacting the availability of network monitoring or security tools that rely on PcapPlusPlus.
Technical details
A heap-based buffer overflow (out-of-bounds read) exists in the Telnet Subnegotiation Packet Handler of PcapPlusPlus 25.05. The vulnerability is located in the `pcpp::TelnetLayer::getSubCommand` function within `Packet++/src/TelnetLayer.cpp`. The root cause is a failure to rigorously verify buffer lengths when processing truncated Telnet packets; specifically, the code attempts to access memory at an offset of 2 without ensuring the buffer length is at least 3 bytes. A remote attacker can exploit this by sending malformed Telnet packets, potentially leading to a program crash (Denial of Service). A patch has been released in commit 98e671010bc7c87b95898c22ae289220ae92542b.
Affected products
- seladb PcapPlusPlus 25.05
Timeline
- 2026-05-25: disclosed: Issue reported on GitHub repository
- 2026-06-24: patched: Fix merged into dev branch
- 2026-06-29: advisory: NVD publication date
References
- https://github.com/seladb/PcapPlusPlus/
- https://github.com/seladb/PcapPlusPlus/commit/98e671010bc7c87b95898c22ae289220ae92542b
- https://github.com/seladb/PcapPlusPlus/issues/2152
- https://github.com/seladb/PcapPlusPlus/pull/2161
- https://github.com/user-attachments/files/28214571/poc.zip
- https://vuldb.com/cve/CVE-2026-13589
- https://vuldb.com/submit/844482