This is the official web site of tcpdump, a powerful command-line packet analyzer; and libpcap, a portable C/C++ library for network traffic capture.
Security Fix(es):
In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.(CVE-2026-0799)
The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.(CVE-2026-18238)
rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.(CVE-2026-18313)
libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.(CVE-2026-31911)
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.(CVE-2026-31912)
libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.(CVE-2026-6244)
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.(CVE-2026-6554)
CVE-2026-18238 is a medium severity vulnerability in the libpcap library used by The Tcpdump Group. The rpcap client code improperly validates headers in RPCAP_MSG_PACKET messages from the server. This flaw allows a malicious server to cause the client to treat up to 20 bytes of memory beyond the buffer as part of the captured packet, potentially exposing sensitive memory contents.
CVE-2026-18313 is a medium severity vulnerability in libpcap's rpcapd component where memory allocated for certain client messages is never freed, causing a memory leak. This leak occurs during normal use and can be accelerated by a malicious client sending specific requests. The issue affects libpcap versions from 1.9.0 up to but not including 1.10.7. There is no indication of confidentiality or integrity impact, only availability degradation due to memory exhaustion.
CVE-2026-6554 is a high-severity vulnerability in libpcap's BPF interpreter where a crafted filter program or network packet can cause an infinite loop. The issue arises because the 'ja L' BPF instruction offset is treated as a signed integer for looping but lacks limits on loop iterations, leading to a potential denial of service.
libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.
CVE-2026-31911 is a medium severity vulnerability in libpcap's BPF interpreter where an invalid opcode in a crafted filter program causes the process to abort. This results in a reachable assertion that terminates the OS process running libpcap. No confidentiality or integrity impact is reported, only availability is affected.
CVE-2026-31912 is a medium severity vulnerability in libpcap's BPF interpreter where improper validation of filter program offsets can cause out-of-bounds memory reads. Specifically, the interpreter does not detect reaching the end of the filter buffer without a return instruction or jumps to offsets outside the buffer. This can lead to reading large areas of OS process memory on both 32-bit and 64-bit architectures.
On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.
pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.