Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-09-05T18:48:39 libpcap: libpcap: Out-of-bounds read and write vulnerability allows arbitrary memory access 8.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H CWE-125

In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.

A flaw was found in libpcap. The Berkeley Packet Filter (BPF) interpreter in libpcap does not properly validate register indexes in BPF instructions. A local attacker could craft a malicious filter program to trigger an out-of-bounds read and write vulnerability. This could allow the attacker to read and write arbitrary operating system process memory, potentially leading to information disclosure or arbitrary code execution.

This is an Important vulnerability in libpcap where a flaw in the BPF interpreter's register index validation can lead to out-of-bounds memory access. Exploitation requires a local attacker to provide a specially crafted BPF filter program to an application utilizing libpcap, which is considered an uncommon use case. This could result in arbitrary read and write operations within the OS process memory. Red Hat Enterprise Linux 10 Affected libpcap Red Hat Enterprise Linux 6 Affected libpcap Red Hat Enterprise Linux 7 Affected libpcap Red Hat Enterprise Linux 8 Affected libpcap Red Hat Enterprise Linux 9 Affected libpcap Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-0799 https://nvd.nist.gov/vuln/detail/CVE-2026-0799 https://github.com/the-tcpdump-group/libpcap/commit/48e8960a7108e9e828f9d7bdc7e97bdab841aec7