The vulnerability allows a crafted BPF filter program to cause the libpcap BPF interpreter to loop infinitely, since the offset in the 'ja L' instruction is treated as a signed integer without limiting iterations. This results in a denial of service, potentially freezing or exhausting CPU resources for any process that uses libpcap, such as tcpdump or other packet‑capture utilities, without compromising confidentiality or integrity.

The vulnerability affects libpcap versions released by The Tcpdump Group before 1.10.7. Any distribution or custom build of libpcap that has not yet been upgraded to 1.10.7 is susceptible.

The CVSS score of 5.5 shows a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. The attack vector is inferred to require an attacker who can supply a crafted BPF filter program to a libpcap consumer; this could be local or remote depending on how the filter is provided. Exploitation would lead to process starvation or repeated CPU usage but does not allow direct code execution or data exfiltration.