CVE-2026-0799

libpcap's BPF interpreter fails to validate the index of scratch-memory (M) register load/store instructions, which is a 32-bit unsigned value that must not exceed 15; a crafted filter program with an out-of-range index triggers out-of-bounds memory access. On 64-bit architectures the interpreter can read and write process memory in a 16GiB window starting at the current stack frame, and on 32-bit architectures anywhere in the process address space. An attacker who can get an application using libpcap to execute a malicious filter program (a local, low-privilege vector per the CVSS 3.1 score of 8.7) can disclose process memory, corrupt memory, or crash the process, with the potential for further impact reflected in the high integrity and confidentiality ratings. Any system or application built against libpcap is affected, particularly software that accepts packet-filter programs or expressions from untrusted users; downstream consumers such as tcpdump-class tools and other capture applications link the library. No public proof-of-concept, CISA KEV listing, or exploitation activity is known, and EPSS estimates only a 0.1% probability of exploitation in the next 30 days.

What to do: Update libpcap to the patched release identified in the tcpdump.org security advisory for CVE-2026-0799 (specific version numbers are not provided in the available data), then restart or rebuild dependent applications such as tcpdump and other capture tools so they pick up the fixed library. Audit any service or application that loads BPF filter programs from untrusted users, since crafted programs are the trigger, and treat input of raw filter programs as untrusted until patched.