Vulnerability · Published Dec 31, 2025 · Assigned by Tcpdump
CVE-2025-11961OOBR and OOBW in pcap_ether_aton() in libpcap
Low 1.9
In plain English
A low-severity heap buffer overflow in libpcap from The Tcpdump Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | libpcap | 1.10.7-r0 | ALPINE-CVE-2025-11961 |
| Alpine:v3.22 | libpcap | 1.10.7-r0 | ALPINE-CVE-2025-11961 |
| Alpine:v3.23 | libpcap | 1.10.7-r0 | ALPINE-CVE-2025-11961 |
| Alpine:v3.24 | libpcap | 1.10.6-r0 | ALPINE-CVE-2025-11961 |
| Debian:12 | libpcap | no fix listed | DEBIAN-CVE-2025-11961 |
| Debian:13 | libpcap | no fix listed | DEBIAN-CVE-2025-11961 |
| Debian:14 | libpcap | 1.10.6-1 | DEBIAN-CVE-2025-11961 |
| Ubuntu:22.04:LTS | libpcap | no fix listed | UBUNTU-CVE-2025-11961 |
| Ubuntu:24.04:LTS | libpcap | no fix listed | UBUNTU-CVE-2025-11961 |
| Ubuntu:25.10 | libpcap | no fix listed | UBUNTU-CVE-2025-11961 |
| Ubuntu:26.04:LTS | libpcap | no fix listed | UBUNTU-CVE-2025-11961 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Tcpdump Group | libpcap | 0 – before 1.10.6 |
Weakness: CWE-126, CWE-122 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N