CVE-2026-31912

libpcap's userspace BPF interpreter fails to detect two malformed conditions in a loaded filter program: execution reaching the end of the filter buffer without a return instruction, and a jump instruction whose offset resolves to a pointer outside the buffer. If such a crafted filter program is executed — which the maintainer notes happens only in uncommon use cases, since filters normally run in the kernel — the interpreter reads process memory far beyond the buffer, sweeping up to 32 GiB around it on 64-bit systems or the entire address space on 32-bit systems. The consequence is a crash of the capturing process (a local denial of service): the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N, availability-only) confirms a low-privilege local availability issue with no confidentiality or integrity impact. Potentially affected are applications that link libpcap and apply user-supplied filter programs through its interpreter, most prominently tcpdump and other packet-capture and monitoring tools built on the library. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known, and EPSS estimates only a 0.1% chance of exploitation within 30 days.

What to do: Upgrade to libpcap 1.10.7 — per the maintainer this release fixes this flaw along with six other vulnerabilities — and rebuild or update dependent packages such as tcpdump against the updated library. Until then, restrict which local users can attach crafted BPF filters to processes running libpcap's interpreter path. Given the local attack vector, ~0.1% EPSS, and no known public PoC, treat this as routine patching rather than an emergency.