CVE-2025-11961: the tcpdump group libpcap Heap-based Buffer Overflow

Vulnerability summary

CVE-2025-11961 is a low (CVSS 1.9) Heap-based Buffer Overflow vulnerability in the tcpdump group libpcap. EPSS estimates a 0.12% chance of exploitation in the next 30 days, higher than 1.5% of scored vulnerabilities.

Timeline

1. 31-12-2025
   PublishedVulnerability first disclosed.
2. 02-01-2026
   Last modifiedVulnerability information updated.

Description

pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.

• CWE-122Heap-based Buffer OverflowA heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
• CWE-126Buffer Over-readThe product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.