CVE-2026-31911 PUBLISHED

abort() in libpcap before 1.10.7 on an invalid BPF opcode

Assigner: Tcpdump
Reserved: 10.03.2026 Published: 05.09.2026 Updated: 05.09.2026

libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 5.5

Attack Vector	Local	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	The Tcpdump Group
Product	libpcap
Versions	Default: unaffected affected from 0 to 1.10.7 (excl.)

Affected Configurations

The problem is specific to applications that use pcap_offline_filter() or bpf_filter() with an externally-supplied compiled filter program (whether validated or not).

Exploits

A functional exploit exists.

Solutions

Upgrade to libpcap 1.10.7.

Credits

FuzzAnything Organization reporter

References

https://github.com/the-tcpdump-group/libpcap/commit/a715bcdde830299cba4171514385cb17ec19b6e9

Problem Types

CWE-617 Reachable Assertion CWE