The libpcap BPF interpreter accepts a 32‑bit scratch register index without bounds checking. When a crafted filter program uses an out‑of‑range index, the interpreter reads or writes data at addresses far beyond the intended 16‑GiB range for 64‑bit architectures or the entire address space for 32‑bit systems. This results in an out‑of‑bounds read (OOBR) or write (OOBW) that can expose or corrupt memory of the host process, potentially leading to arbitrary code execution or data exfiltration. The flaw maps to CWE‑125, CWE‑129 and CWE‑787.

All releases of libpcap from the Tcpdump Group before version 1.10.7 are affected. The vulnerability is in the BPF interpreter component used by tcpdump, wireshark and any application that links with libpcap for packet filtering.

The CVSS score of 8.7 indicates high severity, and the EPSS score is not available, so the exploitation probability is unclear. The flaw is not listed in the CISA KEV catalog. The vulnerability runs with the privileges of the calling process, so the most likely attack vector is a locally‑deployed malicious filter program supplied by an attacker who can influence the filter passed to libpcap. In privileged contexts, the memory overwrite could lead to privilege escalation or data theft, making this a critical risk for systems that load untrusted filter programs or run libpcap as root.