CVE-2026-6244 PUBLISHED

division by zero in libpcap before 1.10.7

Assigner: Tcpdump
Reserved: 13.04.2026 Published: 05.09.2026 Updated: 05.09.2026

libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 5.5

Product Status

Vendor The Tcpdump Group
Product libpcap
Versions Default: unaffected
  • affected from 0 to 1.10.7 (excl.)

Affected Configurations

The problem is specific to applications that use pcap_offline_filter() or bpf_filter() with an externally-supplied compiled filter program without validating the program first.

Exploits

A functional exploit exists.

Workarounds

Validate every filter program that has not been produced by a local call to pcap_compile().

Solutions

Upgrade to libpcap 1.10.7.

Credits

  • Denis Ovsienko finder

References

Problem Types

  • CWE-369 Divide By Zero CWE