CVE-2026-6244: division by zero in libpcap before 1.10.7
libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libpcapto a version that resolves this vulnerability.Fixed in 1.10.7
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires local access and low privileges. The attacker must be able to supply or cause use of a crafted BPF filter program containing a div #k or mod #k instruction with an immediate value of zero.
Are all libpcap uses likely to be exposed?
No. The issue is described as affecting uncommon use cases involving crafted filter programs. The provided information does not establish that ordinary or default libpcap configurations process attacker-controlled raw BPF programs.
What is the impact of successful exploitation?
A crafted filter can trigger a division-by-zero condition in the BPF interpreter, resulting in a denial of service. No confidentiality or integrity impact is indicated by the supplied severity vector.
Which versions need remediation?
Libpcap versions before 1.10.7 are affected. Updating to 1.10.7 or later addresses the missing zero-value check.