CVE-2026-0799 OOBR and OOBW in libpcap before 1.10.7
A crafted BPF filter can cause out-of-bounds memory access in libpcap, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-0799?
CVE-2026-0799 is a high-severity memory corruption vulnerability in The Tcpdump Group libpcap, published on 5 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading and writing the OS process memory in the 16GiB starting at the current stack frame on 64-bit architectures and in the entire address space on 32-bit architectures.
Which versions are affected by CVE-2026-0799?
Linux distribution packages (25)
libpcap AlmaLinux:10 | All versions | 14:1.10.4-7.el10_2.1 |
libpcap-devel AlmaLinux:10 | All versions | 14:1.10.4-7.el10_2.1 |
libpcap AlmaLinux:8 | All versions | 14:1.9.1-6.el8_10 |
libpcap-devel AlmaLinux:8 | All versions | 14:1.9.1-6.el8_10 |
libpcap AlmaLinux:9 | All versions | 14:1.10.0-4.el9_8.1 |
libpcap-devel AlmaLinux:9 | All versions | 14:1.10.0-4.el9_8.1 |
libpcap Red Hat:enterprise_linux:10.2 | All versions | 14:1.10.4-7.el10_2.1 |
libpcap-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 14:1.10.4-7.el10_2.1 |
libpcap-debugsource Red Hat:enterprise_linux:10.2 | All versions | 14:1.10.4-7.el10_2.1 |
libpcap-devel Red Hat:enterprise_linux:10.2 | All versions | 14:1.10.4-7.el10_2.1 |
libpcap Red Hat:enterprise_linux:8::baseos | All versions | 14:1.9.1-6.el8_10 |
libpcap-debuginfo Red Hat:enterprise_linux:8::baseos | All versions | 14:1.9.1-6.el8_10 |
libpcap-debugsource Red Hat:enterprise_linux:8::baseos | All versions | 14:1.9.1-6.el8_10 |
libpcap-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 14:1.9.1-6.el8_10 |
libpcap-debugsource Red Hat:enterprise_linux:8::crb | All versions | 14:1.9.1-6.el8_10 |
libpcap-devel Red Hat:enterprise_linux:8::crb | All versions | 14:1.9.1-6.el8_10 |
libpcap Red Hat:enterprise_linux:9::baseos | All versions | 14:1.10.0-4.el9_8.1 |
libpcap-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 14:1.10.0-4.el9_8.1 |
libpcap-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 14:1.10.0-4.el9_8.1 |
libpcap-debuginfo Red Hat:enterprise_linux:9::crb | All versions | 14:1.10.0-4.el9_8.1 |
libpcap-debugsource Red Hat:enterprise_linux:9::crb | All versions | 14:1.10.0-4.el9_8.1 |
libpcap-devel Red Hat:enterprise_linux:9::crb | All versions | 14:1.10.0-4.el9_8.1 |
libpcap Rocky Linux:10 | All versions | 4:1.10.4-7.el10_2.1 |
libpcap Rocky Linux:8 | All versions | 4:1.9.1-6.el8_10 |
libpcap Rocky Linux:9 | All versions | 4:1.10.0-4.el9_8.1 |
How do I fix CVE-2026-0799?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-0799 being exploited?
There is no known exploitation of CVE-2026-0799 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-0799, ALSA-2026:74441, ALSA-2026:74442, ALSA-2026:76045, AZL-99744, AZL-99933 and 15 more.