CVE-2026-31912: the tcpdump group libpcap Out-of-bounds Read

Vulnerability summary

CVE-2026-31912 is a medium (CVSS 5.5) Out-of-bounds Read vulnerability in the tcpdump group libpcap. EPSS estimates a 0.10% chance of exploitation in the next 30 days, higher than 1% of scored vulnerabilities.

Timeline

1. 05-09-2026
   PublishedVulnerability first disclosed.
2. 08-09-2026
   Last modifiedVulnerability information updated.

Description

libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-823Use of Out-of-range Pointer OffsetThe product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
• CWE-1285Improper Validation of Specified Index, Position, or Offset in InputThe product receives input that is expected to specify an index, position, or offset into an indexable resource such as a buffer or file, but it does not validate or incorrectly validates that the specified index/position/offset has the required properties.