Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-09-05 | 2 | Disclosure1Patch1 |
| 2026-09-06 | 2 | Patch2 |
Someone who can feed your packet-capture app a crafted BPF filter can make libpcap walk process memory. Tcpdump Group shipped libpcap 1.10.7 today with seven related CVEs (CVE-2026-0799 lead). Upgrade now. https://hol.org/blog/cve-2026-0799-libpcap-bpf-rpcap-1-10-7 https://t.co/c3ohyULECO
Post summary
This brief announcement urges users to upgrade libpcap to version 1.10.7 to address multiple related CVEs, particularly CVE‑2026‑0799.
CVE-2026-0799: libpcap's BPF interpreter doesn't validate the scratch memory register index. A crafted filter program can force reads and writes into process memory outside the intended bounds. CVSS 8.7, high severity, patched in 1.10.7 by The Tcpdump Group. #CVE #libpcap #VulnerabilityManagement #InfoSec #BPF
Post summary
The text reports that CVE-2026-0799 affects libpcap's BPF interpreter, allowing out‑of‑bounds memory reads/writes via crafted filters; CVSS 8.7 and patched in libpcap 1.10.7.
libpcap 1.10.7 fixes a BPF interpreter memory write Include Security reported in 2018. https://severitydaily.com/libpcap-1-10-7-cve-2026-0799-bpf-scratch-register-include-security-2018/
Post summary
Libpcap 1.10.7 releases a fix for the BPF interpreter memory write vulnerability reported in 2018, addressing CVE-2026-0799.
🚨High - libpcap BPF Scratch Register OOB Read/Write (CVE-2026-0799) libpcap’s BPF interpreter fails to bounds-check the scratch memory register index for certain BPF load/store ops. If an app passes externally supplied compiled filters to pcap_offline_filter() or bpf_filter() without validation, a crafted program can drive OOB reads/writes into process memory (up to ~16GiB from the current stack frame on 64-bit). 👉Affected: libcap < 1.10.7 | Upgrade to 1.10.7 to mitigate.
Post summary
CVE-2026-0799 is an out‑of‑bounds read/write flaw in libpcap’s BPF interpreter caused by unchecked scratch register indexes; upgrading to libpcap 1.10.7 mitigates the issue.