CVE-2026-31911: abort() in libpcap before 1.10.7 on an invalid BPF opcode
libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libpcapto a version that resolves this vulnerability.Fixed in 1.10.7
Event History
Frequently Asked Questions
Who can trigger the process termination?
An attacker needs the ability to supply a crafted BPF filter program containing an invalid opcode to a process that uses the affected libpcap BPF interpreter. The published vector indicates local access and low privileges are required.
What is the impact of successful exploitation?
The affected process calls abort() and terminates, resulting in a denial of service. No confidentiality or integrity impact is indicated by the provided severity vector.
Which versions are affected?
libpcap versions before 1.10.7 are affected. The provided data does not identify whether any particular application configuration exposes BPF filter submission by default.