Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 190

Export CSV
CVE-2026-6554

infinte loop in libpcap before 1.10.7

libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. A crafted filter program or the 'protochain' primitive used on a crafted network packet can cause the interpreter to loop infinitely.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Tcpdump
Products
Libpcap
CVE-2018-16301

tcpdump: Buffer overflow in the -F command line argument parser

The command-line argument parser in tcpdump before 4.99.0 has a buffer overflow in tcpdump.c:read_infile(). To trigger this vulnerability the attacker needs to create a 4GB file on the local filesystem and to specify the file name as the value of the -F command-line argument of tcpdump.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Tcpdump
Products
Tcpdump
CVE-2026-18313

rpcapd memory leak in libpcap before 1.10.7

rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Tcpdump
Products
Libpcap
CVE-2026-31911

abort() in libpcap before 1.10.7 on an invalid BPF opcode

libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tcpdump
Products
Libpcap
CVE-2026-18238

OOBR in rpcap client in libpcap before 1.10.7

The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Tcpdump
Products
Libpcap
CVE-2026-31912

OOBR in libpcap before 1.10.7

libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tcpdump
Products
Libpcap
CVE-2026-6244

division by zero in libpcap before 1.10.7

libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tcpdump
Products
Libpcap
CVE-2026-0799

OOBR and OOBW in libpcap before 1.10.7

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tcpdump
Products
Libpcap
CVE-2017-12901

tcpdump: Buffer over-read in print-eigrp.c:eigrp_print() in EIGRP parser

The EIGRP parser in tcpdump before 4.9.2 has a buffer over-read in print-eigrp.c:eigrp_print().

CVSS 3.1 · 9.8 Critical EPSS 2.4% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2007-1218

tcpdump denial of service

Off-by-one buffer overflow in the parse_elements function in the 802.11 printer code (print-802_11.c) for tcpdump 3.9.5 and earlier allows remote attackers to cause a denial of service (crash) via a crafted 802.11 frame. NOTE: this was originally referred to as heap-based, but it might be stack-based.

CVSS 2.0 · 6.8 Medium EPSS 2.9% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2007-3798

tcpdump BGP integer overflow

Integer overflow in print-bgp.c in the BGP dissector in tcpdump 3.9.6 and earlier allows remote attackers to execute arbitrary code via crafted TLVs in a BGP packet, related to an unchecked return value.

CVSS 3.1 · 9.8 Critical EPSS 70.4% KEV · Not listed
Vendors
Apple Canonical Debian and 4 more
Products
Mac Os X Mac Os X Server Ubuntu Linux and 5 more
CVE-2004-0184

security flaw

Integer underflow in the isakmp_id_print for TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via an ISAKMP packet with an Identification payload with a length that becomes less than 8 during byte order conversion, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.

CVSS 2.0 · 5.0 Medium EPSS 60.3% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2004-0183

security flaw

TCPDUMP 3.8.1 and earlier allows remote attackers to cause a denial of service (crash) via ISAKMP packets containing a Delete payload with a large number of SPI's, which causes an out-of-bounds read, as demonstrated by the Striker ISAKMP Protocol Test Suite.

CVSS 2.0 · 5.0 Medium EPSS 5.6% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2025-11964

OOBW in utf_16le_to_utf_8_truncated() in libpcap

On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.

CVSS 3.1 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Microsoft Tcpdump
Products
Windows Libpcap
CVE-2025-11961

OOBR and OOBW in pcap_ether_aton() in libpcap

pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.

CVSS 3.1 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Tcpdump
Products
Libpcap
CVE-2017-13037

tcpdump: Buffer over-read in print-ip.c:ip_printts() in IP parser

The IP parser in tcpdump before 4.9.2 has a buffer over-read in print-ip.c:ip_printts().

CVSS 3.1 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2017-13027

tcpdump: Buffer over-read in print-lldp.c:lldp_mgmt_addr_tlv_print() in LLDP parser

The LLDP parser in tcpdump before 4.9.2 has a buffer over-read in print-lldp.c:lldp_mgmt_addr_tlv_print().

CVSS 3.1 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2017-13035

tcpdump: Buffer over-read in print-isoclns.c:isis_print_id() in ISO IS-IS parser

The ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c:isis_print_id().

CVSS 3.1 · 9.8 Critical EPSS 3.4% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump
CVE-2017-13034

tcpdump: Buffer over-read in print-pgm.c:pgm_print() in PGM parser

The PGM parser in tcpdump before 4.9.2 has a buffer over-read in print-pgm.c:pgm_print().

CVSS 3.1 · 9.8 Critical EPSS 3.2% KEV · Not listed
Vendors
Redhat Tcpdump
Products
Enterprise Linux Tcpdump