Tcpdump

By the Year

In 2026 there have been 3 vulnerabilities in Tcpdump with an average score of 5.1 out of ten. Tcpdump did not have any published security vulnerabilities last year. That is, 3 more vulnerabilities have already been reported in 2026 as compared to last year.

Recent Tcpdump Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-18313	Sep 05, 2026	Memory Leak in rpcapd libpcap 1.10.6 (1.9.x) Leading to Denial of Service rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.	Libpcap
CVE-2026-6554	Sep 05, 2026	libpcap BPF Interpreter Infinite Loop before 1.10.7 (CVE-2026-6554) libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. In particular uncommon use cases a crafted filter program can cause the interpreter to loop infinitely.	Libpcap
CVE-2026-31912	Sep 05, 2026	libpcap BPF interpreter OS memory read <=1.10.6 libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.	Libpcap
CVE-2024-8006	Aug 31, 2024	libpcap NULL pointer deref in pcap_findalldevs_ex() Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one of the functions that become available is pcap_findalldevs_ex(). One of the function arguments can be a filesystem path, which normally means a directory with input data files. When the specified path cannot be used as a directory, the function receives NULL from opendir(), but does not check the return value and passes the NULL value to readdir(), which causes a NULL pointer derefence.	Libpcap
CVE-2023-7256	Aug 31, 2024	Libpcap Double-Free in getaddrinfo() Handling In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.	Libpcap
CVE-2023-1801	Apr 07, 2023	Tcpdump 4.99.3 SMB OOB Write via Protocol Decoder The SMB protocol decoder in tcpdump version 4.99.3 can perform an out-of-bounds write when decoding a crafted network packet.	Tcpdump
CVE-2019-15167	Aug 27, 2022	CVE-2019-15167: Buffer Over-Read in tcpdump (<4.9.3) VRRP Parser vrrp_print() The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 3, a different vulnerability than CVE-2018-14463.	Tcpdump
CVE-2021-41043	Jan 05, 2022	Use after free in tcpslice triggers AddressSanitizer Use after free in tcpslice triggers AddressSanitizer, no other confirmed impact.	Tcpslice
CVE-2020-8036	Nov 04, 2020	The tok2strbuf() function in tcpdump 4.10.0-PRE-GIT was used by the SOME/IP dissector in an unsafe way. The tok2strbuf() function in tcpdump 4.10.0-PRE-GIT was used by the SOME/IP dissector in an unsafe way.	Tcpdump
CVE-2020-8037	Nov 04, 2020	The ppp decapsulator in tcpdump 4.9.3 The ppp decapsulator in tcpdump 4.9.3 can be convinced to allocate a large amount of memory.	Tcpdump