Vulnerability · Published Sep 5, 2026 · Assigned by Tcpdump
CVE-2026-31912OOBR in libpcap before 1.10.7
Medium 5.5
In plain English
A medium-severity out-of-bounds read in libpcap from The Tcpdump Group. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.21 | libpcap | 1.10.7-r0 | ALPINE-CVE-2026-31912 |
| Alpine:v3.22 | libpcap | 1.10.7-r0 | ALPINE-CVE-2026-31912 |
| Alpine:v3.23 | libpcap | 1.10.7-r0 | ALPINE-CVE-2026-31912 |
| Alpine:v3.24 | libpcap | 1.10.7-r0 | ALPINE-CVE-2026-31912 |
| Debian:12 | libpcap | no fix listed | DEBIAN-CVE-2026-31912 |
| Debian:13 | libpcap | no fix listed | DEBIAN-CVE-2026-31912 |
| Debian:14 | libpcap | 1.10.7-1 | DEBIAN-CVE-2026-31912 |
| Ubuntu:22.04:LTS | libpcap | no fix listed | UBUNTU-CVE-2026-31912 |
| Ubuntu:24.04:LTS | libpcap | no fix listed | UBUNTU-CVE-2026-31912 |
| Ubuntu:26.04:LTS | libpcap | no fix listed | UBUNTU-CVE-2026-31912 |
| Ubuntu:26.10 | libpcap | no fix listed | UBUNTU-CVE-2026-31912 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The Tcpdump Group | libpcap | 0 – before 1.10.7 |
Weakness: CWE-1285, CWE-823, CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H