The vulnerability resides in the BPF interpreter of libpcap, where a lack of a return instruction or an improperly checked jump offset allows execution of out‑of‑bounds reads. A crafted filter program can cause the interpreter to read memory beyond the 32GiB buffer in 64‑bit processes, or the entire address space in 32‑bit processes, potentially exposing sensitive data or triggering a crash. The weakness is a classic memory corruption flaw, classified as a buffer overread, and would likely lead to local data exposure or instability rather than immediate remote code execution.

All installations of libpcap older than version 1.10.7 are affected. The Tcpdump Group’s libpcap library underpins numerous networking tools such as tcpdump, Wireshark, and related packet‑capture utilities. Any system that loads user‑supplied BPF filter programs via libpcap through these tools is at risk.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is not available. The vulnerability is not currently listed in CISA’s KEV catalog. The most probable attack vector involves an attacker supplying a specially crafted BPF filter program to a libpcap‑based application; if the application accepts untrusted filter code, the overflow can occur locally. Current public exploitation evidence is lacking, suggesting that while the weakness exists, it is not being widely exploited yet.