CVE-2026-31912: OOBR in libpcap before 1.10.7
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libpcapto a version that resolves this vulnerability.Fixed in 1.10.7 - Configuration
When using libpcap with filters, migrate code from bpf_filter() to pcap_offline_filter().
libpcap BPF interpreter API usage bpf_filter() -> pcap_offline_filter() = migrate from bpf_filter() to pcap_offline_filter()
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs local access and low privileges, as reflected by the AV:L and PR:L vector. Exploitation also requires an application or use case that accepts or executes a crafted BPF filter program.
Are all libpcap versions affected?
The issue affects libpcap versions before 1.10.7. The provided data does not identify whether any particular operating-system package or application configuration exposes the vulnerable interpreter.
What is the likely impact of successful exploitation?
A crafted filter can make the BPF interpreter read memory outside the filter-program buffer. This can cause availability impact; the supplied vector rates availability as high while confidentiality and integrity are rated as not impacted.
Does architecture affect the potential memory exposure?
Yes. On 64-bit architectures, the interpreter may attempt to read process memory in the 32 GiB around the buffer; on 32-bit architectures, it may attempt reads across the entire address space.