CVE-2026-0799 PUBLISHED

OOBR and OOBW in libpcap before 1.10.7

Assigner: Tcpdump
Reserved: 08.01.2026 Published: 05.09.2026 Updated: 05.09.2026

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
CVSS Score: 8.7

Product Status

Vendor The Tcpdump Group
Product libpcap
Versions Default: unaffected
  • affected from 0 to 1.10.7 (excl.)

Affected Configurations

The problem is specific to applications that use pcap_offline_filter() or bpf_filter() with an externally-supplied compiled filter program without validating the program first.

Exploits

A functional exploit exists.

Workarounds

Validate every filter program that has not been produced by a local call to pcap_compile().

Solutions

Upgrade to libpcap 1.10.7.

Credits

  • Mozilla via the Secure Open Source program sponsor
  • Include Security reporter
  • Denis Ovsienko analyst

References

Problem Types

  • CWE-129 Improper Validation of Array Index CWE
  • CWE-125 Out-of-bounds Read CWE
  • CWE-787 Out-of-bounds Write CWE