CVE-2026-31912
published 2026-09-05CVE-2026-31912: libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.10%
1.1th percentile
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| the_tcpdump_group | libpcap | < 1.10.7 | 1.10.7 |
| the_tcpdump_group | libpcap | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer o
ghsa_unreviewed·2026-09-05
CVE-2026-31912 [MEDIUM] CWE-125 libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer o
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.
VulDB
Tcpdump Group libpcap up to 1.10.6 BPF Interpreter buffer overflow (EUVD-2026-72016)
vuldb·2026-09-05·CVSS 5.5
CVE-2026-31912 [MEDIUM] Tcpdump Group libpcap up to 1.10.6 BPF Interpreter buffer overflow (EUVD-2026-72016)
A vulnerability categorized as problematic has been discovered in Tcpdump Group libpcap up to 1.10.6. This vulnerability affects unknown code of the component BPF Interpreter. Executing a manipulation can lead to buffer overflow.
This vulnerability appears as CVE-2026-31912. The attack requires local access. There is no available exploit.
It is advisable to upgrade the affected component.
Red Hat
libpcap: libpcap: Denial of service via crafted BPF filter program
vendor_redhat·2026-09-05·CVSS 5.5
CVE-2026-31912 [MEDIUM] CWE-125 libpcap: libpcap: Denial of service via crafted BPF filter program
libpcap: libpcap: Denial of service via crafted BPF filter program
A flaw was found in libpcap. The BPF interpreter in libpcap does not correctly handle crafted filter programs, leading to an out-of-bounds read. A local attacker could provide a specially crafted filter program, causing the interpreter to attempt to read memory outside of its allocated buffer. This could result in a denial of service due to an application crash.
Statement: Moderate: A flaw in the libpcap BPF interpreter allows a local attacker to trigger an out-of-bounds read by supplying a specially crafted BPF filter program. This can lead to a denial of service or information disclosure in uncommon use cases where applications process untrusted BPF filters. The impact is limited by the requirement for local access and
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-31912 libpcap: libpcap: Denial of service via crafted BPF filter program [fedora-all]
bugzilla·2026-09-08·CVSS 5.5
CVE-2026-31912 [MEDIUM] CVE-2026-31912 libpcap: libpcap: Denial of service via crafted BPF filter program [fedora-all]
CVE-2026-31912 libpcap: libpcap: Denial of service via crafted BPF filter program [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.
Bugzilla
CVE-2026-31912 libpcap: libpcap: Denial of service via crafted BPF filter program
bugzilla·2026-09-05·CVSS 5.5
CVE-2026-31912 [MEDIUM] CVE-2026-31912 libpcap: libpcap: Denial of service via crafted BPF filter program
CVE-2026-31912 libpcap: libpcap: Denial of service via crafted BPF filter program
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.
2026-09-05
Published