CVE-2026-31912— OOBR in libpcap before 1.10.7
Quick assessment
Affected
The Tcpdump Group libpcap
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
libpcap 的 BPF（Berkeley Packet Filter）解释器存在缺陷：它既无法检测到因缺少返回指令而导致过滤器程序缓冲区末尾被访问的情况，也无法检测出跳转指令的偏移量导致指针越界（超出缓冲区范围）的情况。 在特定的非常规使用场景中，精心构造的过滤器程序可能导致解释器尝试读取缓冲区周围 32GiB 的操作系统进程内存（在 64 位架构上），或在 32 位架构上尝试读取整个地址空间。
Possible ATT&CK Techniques 1 AI
T1202 · Indirect Command ExecutionAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| The Tcpdump Group | libpcap | < 1.10.7 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-31912
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OOBR in libpcap before 1.10.7
Source: CVE Program / CVE List V5
Vulnerability Description
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1285
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| The Tcpdump Group | libpcap | 0 ~ 1.10.7 | - |
|
II. Public POCs for CVE-2026-31912
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-31912
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-31912 (1)
Same Patch Batch · The Tcpdump Group · 2026-09-05 · 7 CVEs total
| CVE-2026-0799 | 8.7 HIGH | OOBR and OOBW in libpcap before 1.10.7 |
| CVE-2026-6244 | 5.5 MEDIUM | division by zero in libpcap before 1.10.7 |
| CVE-2026-6554 | 5.5 MEDIUM | infinte loop in libpcap before 1.10.7 |
| CVE-2026-31911 | 5.5 MEDIUM | abort() in libpcap before 1.10.7 on an invalid BPF opcode |
| CVE-2026-18238 | 5.0 MEDIUM | OOBR in rpcap client in libpcap before 1.10.7 |
| CVE-2026-18313 | 4.3 MEDIUM | rpcapd memory leak in libpcap before 1.10.7 |
IV. Related Vulnerabilities
Same product: libpcap
-
CVE-2026-18238
OOBR in rpcap client in libpcap before 1.10.7 -
CVE-2026-18313
rpcapd memory leak in libpcap before 1.10.7 -
CVE-2026-6554
infinte loop in libpcap before 1.10.7 -
CVE-2026-6244
division by zero in libpcap before 1.10.7 -
CVE-2026-31911
abort() in libpcap before 1.10.7 on an invalid BPF opcode
Same vendor: The Tcpdump Group
-
CVE-2026-18238
OOBR in rpcap client in libpcap before 1.10.7 -
CVE-2026-18313
rpcapd memory leak in libpcap before 1.10.7 -
CVE-2026-6554
infinte loop in libpcap before 1.10.7 -
CVE-2026-6244
division by zero in libpcap before 1.10.7 -
CVE-2026-31911
abort() in libpcap before 1.10.7 on an invalid BPF opcode
Same weakness: CWE-1285
V. Comments for CVE-2026-31912
No comments yet