libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a crafted filter program can cause the interpreter to try reading the OS process memory in the 32GiB around the buffer on 64-bit architectures and in the entire address space on 32-bit architectures.
{
"cwe_ids": [
"CWE-125",
"CWE-1285",
"CWE-823"
],
"cna_assigner": "Tcpdump",
"unresolved_ranges": [
{
"source": "AFFECTED_FIELD",
"extracted_events": [
{
"fixed": "1.10.7"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31912.json"
}[
{
"target": {
"file": "pcap-linux.c"
},
"deprecated": false,
"id": "CVE-2026-31912-02036a0e",
"signature_version": "v1",
"digest": {
"line_hashes": [
"90826599789405136917411892579439047530",
"143922201584573473986728847904814069985",
"194969506526113718028085063520674607748",
"207165464539451182458237553387879602004"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "bpf_filter.c",
"function": "pcapint_validate_filter"
},
"deprecated": false,
"id": "CVE-2026-31912-0dc1d4d6",
"signature_version": "v1",
"digest": {
"function_hash": "36318253481447139488866053184702116809",
"length": 1377.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-bt-monitor-linux.c"
},
"deprecated": false,
"id": "CVE-2026-31912-1b5382b4",
"signature_version": "v1",
"digest": {
"line_hashes": [
"330925306647705117096583846006462065062",
"302604603033129614976809143991764451541",
"2363262583225649649733121627112345116",
"23553948960559728952579748820891740465"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "bpf_filter.c",
"function": "bpf_filter"
},
"deprecated": false,
"id": "CVE-2026-31912-1ded6ca2",
"signature_version": "v1",
"digest": {
"function_hash": "301400507891015058873339445470908603710",
"length": 144.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-dbus.c"
},
"deprecated": false,
"id": "CVE-2026-31912-1e46ed9b",
"signature_version": "v1",
"digest": {
"line_hashes": [
"24230119438482298517890205705948585156",
"17095195497857633647258749516939738750",
"87853662994122072404128456370697797497",
"304601838266410498498339452314486519443"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-haiku.c"
},
"deprecated": false,
"id": "CVE-2026-31912-33421c31",
"signature_version": "v1",
"digest": {
"line_hashes": [
"46839720893338680391390022622482252673",
"337037243088241766096418571814343500814",
"320193098695331218166279286753425263928",
"248479179947660366404647615516557797031",
"2133131282887899360748769551145133176"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-dag.c",
"function": "dag_read"
},
"deprecated": false,
"id": "CVE-2026-31912-35ef6496",
"signature_version": "v1",
"digest": {
"function_hash": "330516210833010683850942178515872545951",
"length": 6859.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-bt-monitor-linux.c",
"function": "bt_monitor_read"
},
"deprecated": false,
"id": "CVE-2026-31912-457bcb75",
"signature_version": "v1",
"digest": {
"function_hash": "75336349531364665499233580199023206703",
"length": 1689.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-npf.c"
},
"deprecated": false,
"id": "CVE-2026-31912-47175a45",
"signature_version": "v1",
"digest": {
"line_hashes": [
"323281914640462317177845028224486075714",
"316449920163394728174241918508365740340",
"34856712233828124577636732101099295163",
"159940287287991006589886710165245455837"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-npf.c",
"function": "pcap_read_npf"
},
"deprecated": false,
"id": "CVE-2026-31912-4bc7ec71",
"signature_version": "v1",
"digest": {
"function_hash": "317166963669819222227323425869439820215",
"length": 2656.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-usb-linux.c"
},
"deprecated": false,
"id": "CVE-2026-31912-590b5600",
"signature_version": "v1",
"digest": {
"line_hashes": [
"165475135286590904774771798796989995813",
"183667310016966830174269008378183195413",
"22823445945544484511143938146096524800",
"176416242618279863130795991818893382294",
"42352009410635211598640068418753321665",
"268925129020593182943553795117901043762",
"174059796462233235184857566014588548199",
"54377971001779559357952579512873058589",
"137639614890554834923861103224638424954",
"93853909779375783492227523319785801664"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-bt-linux.c"
},
"deprecated": false,
"id": "CVE-2026-31912-59487ef6",
"signature_version": "v1",
"digest": {
"line_hashes": [
"163679807288283642744822025834006945469",
"106697231787321083296459304982711334585",
"2363262583225649649733121627112345116",
"23553948960559728952579748820891740465"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-bt-linux.c",
"function": "bt_read_linux"
},
"deprecated": false,
"id": "CVE-2026-31912-5f020a30",
"signature_version": "v1",
"digest": {
"function_hash": "55302248099006235936560051013115263908",
"length": 1668.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-snf.c",
"function": "snf_read"
},
"deprecated": false,
"id": "CVE-2026-31912-612628e0",
"signature_version": "v1",
"digest": {
"function_hash": "339178798844827399458852728191554331913",
"length": 1153.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-usb-linux.c",
"function": "usb_read_linux_bin"
},
"deprecated": false,
"id": "CVE-2026-31912-61a0e279",
"signature_version": "v1",
"digest": {
"function_hash": "266212166340576509444519086672664239193",
"length": 1289.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-dpdk.c",
"function": "pcap_dpdk_dispatch"
},
"deprecated": false,
"id": "CVE-2026-31912-675ad48d",
"signature_version": "v1",
"digest": {
"function_hash": "274723045954839027286622400514501683693",
"length": 2046.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "bpf_filter.c"
},
"deprecated": false,
"id": "CVE-2026-31912-6b07f8f5",
"signature_version": "v1",
"digest": {
"line_hashes": [
"314649259146053598072203518599509374624",
"251651021274875026776127167323355962379",
"26895878754321250192486193138348660052",
"111448713175827248515084270639877512025",
"301144090381445183759995406427158908636",
"107366085520343185895493584170037315452",
"266462604489383990811574369899494277720",
"221026219911686393919107742871936844007",
"289675982325090678889451346320374733594",
"6897786866205436216339623072028313131",
"298912017244777821644188285926516191189",
"55992111609150543789950774311686694532",
"340179347560344395870204797594455942006",
"299892672989285642340903156393271193122",
"145912641141861863708551998383492809864",
"175879034564637406823261903604137505850",
"220032020598823829059683977575104170264",
"103740603350734154972671944230080515518",
"23512026464245810448952967032827100761",
"161566311425170698200840050027336845990",
"249079650356982772045511071029549370389",
"234008057034158693850244627690625991850",
"174262967907024792226037561924779377977",
"291856122864979085085766227073808614943",
"9447323051789245711796978481792974920",
"272393554644763085522374951972461440854",
"291845012347413512779845751181866405937",
"18177804073266457653043023938618158947",
"314173147810160667143379553819616924360",
"157784402737411072814422491335850988714",
"193259454718709904274875043135753578542",
"156265246816413480551105766014780767764",
"150821451971545463769683034150529231893",
"305726040418570152669670012328374171424",
"287100333929836645362338101160458601153",
"255468921910320165137016313177903926390",
"280951619160624305777435404937474336773",
"311698551379298997739542847675137590098",
"93139696142611394618914574307451846233",
"57836222490351375152832780031281422938",
"291766890536457417112182997295068003799",
"263682808840101929936751009523121514003",
"277736751050261255372552347389739065539",
"87668371018110117086074988857665857184",
"218141935038271250197743065976006484535",
"149834838412173375055733679997108258493",
"127597948787275817536134690660222688481",
"165391459231122009107503568523134936944",
"5461393191228920383391558694577344623",
"297141248584288783796958979027742211888"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-dpdk.c"
},
"deprecated": false,
"id": "CVE-2026-31912-6bb63c77",
"signature_version": "v1",
"digest": {
"line_hashes": [
"4970409260365410044981353787779049303",
"19837070381843137044533816938193778191",
"113008351981715063568975012926519435642",
"327451601055367237041608858989685446297"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-snf.c"
},
"deprecated": false,
"id": "CVE-2026-31912-726fb20c",
"signature_version": "v1",
"digest": {
"line_hashes": [
"323391097477292342068488040344602142878",
"228229772641025993758340989738415038821",
"206828187444364030957517381156502274213",
"145060757426348806217524212134411754447"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-dag.c"
},
"deprecated": false,
"id": "CVE-2026-31912-7b0034a5",
"signature_version": "v1",
"digest": {
"line_hashes": [
"170662603844628594702507653605126667831",
"318603641351659733411494914220136020625",
"330234833272344174013451527078482114876",
"174593888972969921447946993421971936529"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "bpf_filter.c",
"function": "pcapint_filter"
},
"deprecated": false,
"id": "CVE-2026-31912-7d53ce5c",
"signature_version": "v1",
"digest": {
"function_hash": "219862724349074468853546090472671282532",
"length": 151.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap.c"
},
"deprecated": false,
"id": "CVE-2026-31912-802026a8",
"signature_version": "v1",
"digest": {
"line_hashes": [
"299585354838623838653921808663102039955",
"256133521214137555700626862765590939045",
"172461285704843038671547443051446911148",
"10741983953276093045081517064622923883"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-bpf.c",
"function": "pcap_read_bpf"
},
"deprecated": false,
"id": "CVE-2026-31912-863a75cb",
"signature_version": "v1",
"digest": {
"function_hash": "328513075405134465189411191711347319850",
"length": 3221.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-netfilter-linux.c",
"function": "netfilter_read_linux"
},
"deprecated": false,
"id": "CVE-2026-31912-8b4d7837",
"signature_version": "v1",
"digest": {
"function_hash": "97851069664788110381760335553517661253",
"length": 3407.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-dbus.c",
"function": "dbus_read"
},
"deprecated": false,
"id": "CVE-2026-31912-900feb48",
"signature_version": "v1",
"digest": {
"function_hash": "51231649232814921884646006520064853320",
"length": 1014.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-netmap.c",
"function": "pcap_netmap_filter"
},
"deprecated": false,
"id": "CVE-2026-31912-970e12ea",
"signature_version": "v1",
"digest": {
"function_hash": "101387381984345663659981218676123636355",
"length": 447.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-int.h"
},
"deprecated": false,
"id": "CVE-2026-31912-9fbf08ea",
"signature_version": "v1",
"digest": {
"line_hashes": [
"209462298451735132736623341102497539094",
"248045274414342835959671504674225944140",
"155071859397263778708322494971671977213",
"150409869546749510975214532211106560205",
"15149597210031168298564472790920371680",
"152250058445482033271960699738643710122"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-linux.c",
"function": "pcap_handle_packet_mmap"
},
"deprecated": false,
"id": "CVE-2026-31912-a4dd9ad7",
"signature_version": "v1",
"digest": {
"function_hash": "170473753837444919329469319370910364829",
"length": 4340.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "savefile.c",
"function": "pcapint_offline_read"
},
"deprecated": false,
"id": "CVE-2026-31912-af946833",
"signature_version": "v1",
"digest": {
"function_hash": "311949052005231501402507775996865737865",
"length": 644.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap.c",
"function": "pcap_offline_filter"
},
"deprecated": false,
"id": "CVE-2026-31912-b3253e6d",
"signature_version": "v1",
"digest": {
"function_hash": "303651452032557286487316704661932120665",
"length": 236.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-usb-linux.c",
"function": "usb_read_linux_mmap"
},
"deprecated": false,
"id": "CVE-2026-31912-b5dde122",
"signature_version": "v1",
"digest": {
"function_hash": "49434897593533435937536735740205765544",
"length": 1918.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-haiku.c",
"function": "pcap_read_haiku"
},
"deprecated": false,
"id": "CVE-2026-31912-bfac043e",
"signature_version": "v1",
"digest": {
"function_hash": "74278598325852950813936812599851569180",
"length": 1143.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "savefile.c"
},
"deprecated": false,
"id": "CVE-2026-31912-d14ef1ef",
"signature_version": "v1",
"digest": {
"line_hashes": [
"138520905899703577654766552270496452426",
"292329051030126760783224820312437493287",
"321652916566333017170217556530418442086",
"169626965485635418679986585042386793066"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-netfilter-linux.c"
},
"deprecated": false,
"id": "CVE-2026-31912-d21fe371",
"signature_version": "v1",
"digest": {
"line_hashes": [
"27483087534282076066631745895658140089",
"94852843724969741774718531510964354101",
"184650836362304155326036080682848966309",
"230402673894917616730608635663766048655",
"259038017266072564615797562187994696947"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-rdmasniff.c"
},
"deprecated": false,
"id": "CVE-2026-31912-d5b20c71",
"signature_version": "v1",
"digest": {
"line_hashes": [
"107045519357910567031847559286206609094",
"16283208955034446173638194685121026649",
"231184180854048757493523375882655254566",
"112192928140330060586103790062892412350"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-netmap.c"
},
"deprecated": false,
"id": "CVE-2026-31912-d8e474d9",
"signature_version": "v1",
"digest": {
"line_hashes": [
"181705868554147839381742858001365294173",
"124174006329148009476773054341299397855",
"110389555267169009070111899132542893366",
"193605936725253283384586713484065579345"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "dlpisubs.c",
"function": "pcap_process_pkts"
},
"deprecated": false,
"id": "CVE-2026-31912-e4bdb572",
"signature_version": "v1",
"digest": {
"function_hash": "227990940455143701963984435005077976918",
"length": 1600.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-bpf.c"
},
"deprecated": false,
"id": "CVE-2026-31912-e5d9af43",
"signature_version": "v1",
"digest": {
"line_hashes": [
"34616146107340905209267800589310853292",
"83910755615744600171407949061770773655",
"84273594861186587428312520597978541066",
"159530020043885817195229698534895378939"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "dlpisubs.c"
},
"deprecated": false,
"id": "CVE-2026-31912-f2d5b79c",
"signature_version": "v1",
"digest": {
"line_hashes": [
"131557392478541763359850263549804335722",
"90367982607862475177158964106339890458",
"181334140777484872014236070588152970225",
"106816854899105565147644387753453793654"
],
"threshold": 0.9
},
"signature_type": "Line",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
},
{
"target": {
"file": "pcap-rdmasniff.c",
"function": "rdmasniff_read"
},
"deprecated": false,
"id": "CVE-2026-31912-ffbc3be3",
"signature_version": "v1",
"digest": {
"function_hash": "149654924256969144156821559396128542879",
"length": 1358.0
},
"signature_type": "Function",
"source": "https://github.com/the-tcpdump-group/libpcap/commit/d3f358d3cffbe1ecb94d5284b3e81f052a0adcb9"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31912.json"
"2026-09-07T08:07:19Z"