https://seclists.org/oss-sec/2026/q3/690: libpcap 1.10.7 fixes 7 vulnerabilities
Affected Software
Frequently Asked Questions
Which deployments have the greatest remote exposure?
Deployments that deliberately enable libpcap remote packet capture are exposed to experimental code with potential for remote exploitation. This applies to both the libpcap client and the rpcapd server in an rpcap connection, particularly in production or non-trusted environments.
Can remote packet capture be enabled unintentionally?
Yes. Packages built with non-default build options should be checked to ensure those options do not accidentally enable remote packet capture.
Does upgrading alone address CVE-2026-31912 for applications using bpf_filter()?
No. To obtain the effect of the CVE-2026-31912 fix, applications using the deprecated bpf_filter() must be migrated to pcap_offline_filter().
What should package maintainers do if they intentionally ship remote packet capture support?
They should clearly tell package users that it includes experimental code with potential for remote exploitation. The remote capture code is described as not yet safe enough for production or non-trusted environments.