CVE-2026-0799: OOBR and OOBW in libpcap before 1.10.7
In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libpcapto a version that resolves this vulnerability.Fixed in 1.10.7
Event History
Frequently Asked Questions
Which deployments are affected?
libpcap versions before 1.10.7 are affected. The vulnerability is local according to the supplied attack vector and requires low privileges.
What must an attacker be able to do to exploit this issue?
An attacker needs to provide a crafted BPF filter program that uses a scratch-memory load or store instruction with an out-of-range register index. The issue is described as occurring in uncommon use cases.
How can I determine whether a system is vulnerable?
Check the installed libpcap version. Versions earlier than 1.10.7 should be treated as affected.
What is the potential impact on different architectures?
On 64-bit architectures, the interpreter may read or write process memory within the 16 GiB beginning at the current stack frame. On 32-bit architectures, attempted reads and writes can reach the entire address space.