CVE-2025-11961: 
Nmap vulnerability analysis and mitigation

CVE-2025-11961 is a heap-based buffer overflow and buffer over-read vulnerability in the pcap_ether_aton() function of libpcap, a widely used packet capture library maintained by The Tcpdump Group. The function accepts a string argument expected to be a well-formed MAC-48 address, but due to poor input validation and documentation, passing a malformed string causes the function to read beyond the end of the input string and write beyond the end of the allocated output buffer. Affected versions include libpcap prior to 1.10.6, as well as dependent packages such as cbl2_libpcap_1.10.1-4/5, azl3_libpcap_1.10.5-1, and associated nmap packages. The vulnerability was published on December 31, 2025, with a patch released on January 2, 2026. It carries a CVSS v3.1 base score of 1.9 (Low) (Microsoft MSRC, ENISA EUVD).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-126 (Buffer Over-read). The pcap_ether_aton() function has historically been part of libpcap's public API but was designed with the assumption that callers would always supply a well-formed MAC-48 address string — an assumption that was never enforced or clearly documented. The function used a simple parsing loop that did not validate input format, allowing a malformed string to cause out-of-bounds reads (OOBR) from the input and out-of-bounds writes (OOBW) to the fixed-size allocated output buffer. The fix, committed to the libpcap repository, replaces the simple loop with new validation functions that require the input to match a supported MAC address format before processing (libpcap GitHub commit). The vulnerability was reported by Jin Wei, Kunwei Qian, and Ping Chen.

Successful exploitation results in limited integrity impact through memory corruption — specifically, data may be written beyond the allocated heap buffer boundary. Confidentiality and availability are not directly impacted per the CVSS assessment. The attack requires local access with high privileges, significantly limiting the practical blast radius; however, memory corruption could theoretically be leveraged for further exploitation in applications that pass untrusted input to pcap_ether_aton() (ENISA EUVD, Microsoft MSRC).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.011% (0.000110), reflecting a very low probability of exploitation in the near term. The attack vector is local, requires high privileges, and has high attack complexity, all of which substantially reduce exploitability (ENISA EUVD).

The primary remediation is to update libpcap to version 1.10.6 or later, which includes the fix replacing the vulnerable parsing loop with proper input validation in pcap_ether_aton(). Microsoft released security updates for affected Azure Linux and CBL-Mariner packages on January 2, 2026. As a workaround, applications using libpcap should validate and sanitize all MAC address strings before passing them to pcap_ether_aton(), and processes using libpcap should be run with minimum necessary privileges to reduce attack surface (libpcap GitHub commit, Microsoft MSRC). Distribution-specific updates have also been released for Slackware (SSA-2026-001-02), Mageia (MGASA-2026-0005), Fedora, and SUSE.

The vulnerability received routine coverage from Linux distribution security channels, including Slackware, Mageia, Fedora, SUSE, and openSUSE, all of which issued advisories and package updates. German Linux security outlet Pro-Linux.de published multiple advisories tracking the issue across distributions. No significant researcher commentary or notable social media discussion has been identified beyond standard vulnerability tracking and distribution update announcements (linuxsecurity.com Slackware, linuxsecurity.com Mageia).