Buffer Overflow Vulnerability in libpcap BPF Interpreter by TCPDump

CVE-2026-31912

What is CVE-2026-31912?

The libpcap BPF interpreter is susceptible to a buffer overflow which can occur when the interpreter processes a crafted filter program lacking a proper return instruction. This vulnerability allows the interpreter to access memory locations outside its designated buffer. For 64-bit systems, this results in a potential read of the OS process memory within a 32GiB range around the buffer, while 32-bit architectures are compromised within the entire address space. Attackers can exploit this vulnerability through specially crafted BPF filter programs, leading to unauthorized memory access.

References