CVE-2026-31912: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-31912 is a buffer boundary validation flaw in the libpcap BPF (Berkeley Packet Filter) interpreter that can allow a local low-privileged attacker to trigger out-of-bounds memory reads via a crafted filter program. The vulnerability affects libpcap versions prior to 1.10.7, maintained by The Tcpdump Group. It was published on September 5, 2026, with a patch committed the same day. The CVSS v3.1 base score is 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause lies in pcapint_filter_with_aux_data(), which previously had no awareness of the number of instructions in the filter program it was executing (CWE-125, CWE-823, CWE-1285). The interpreter assumed the program counter would always remain within the bounds of the provided filter program and always reach a return (BPF_RET) instruction — an assumption that holds for libpcap-generated programs but not for externally supplied programs passed via pcap_offline_filter() or the deprecated bpf_filter(). A crafted filter program lacking a return instruction, or containing a jump instruction with an offset pointing outside the buffer, causes the interpreter to read adjacent OS process memory: approximately 32 GiB around the buffer on 64-bit architectures, or the entire address space on 32-bit architectures. The fix adds a proglen parameter to pcapint_filter_with_aux_data() and enforces bounds checks before and during execution, including special handling for unconditional BPF_JA jumps (libpcap commit, GitHub Advisory).

Successful exploitation can cause the libpcap-using process to crash (via SIGSEGV or abort()) or exhibit undefined behavior due to out-of-bounds memory reads, resulting in a denial of service. There is no confidentiality or integrity impact identified — the vulnerability is limited to availability. Applications relying on libpcap for packet capture and filtering (e.g., tcpdump, Wireshark, network monitoring tools) could be disrupted if they process externally supplied BPF filter programs (GitHub Advisory, libpcap commit).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The EPSS score is 0.0, reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and the ability to supply a crafted BPF filter program to a vulnerable code path (specifically pcap_offline_filter() or the deprecated bpf_filter()), limiting the practical attack surface (Feedly, GitHub Advisory).

1. Identify target: Locate a system running an application that uses libpcap < 1.10.7 and accepts externally supplied BPF filter programs via pcap_offline_filter() or the deprecated bpf_filter() API.
2. Craft malicious BPF program: Construct a BPF filter program that either (a) lacks a BPF_RET return instruction, causing the interpreter to advance the program counter beyond the buffer, or (b) contains a BPF_JA unconditional jump with an offset that resolves to a pointer outside the filter program buffer.
3. Supply the crafted program: Provide the malicious filter program to the target application through whatever interface it exposes for BPF filter input (e.g., a file, command-line argument, or API call).
4. Trigger execution: Cause the application to process a packet through the filter, invoking the vulnerable BPF interpreter with the crafted program.
5. Achieve denial of service: The interpreter reads memory outside the filter buffer, causing a SIGSEGV crash or undefined behavior, resulting in process termination (libpcap commit, GitHub Advisory).

• Process: Unexpected crashes (SIGSEGV or abort()) in processes using libpcap (e.g., tcpdump, dumpcap, custom network monitoring tools), particularly when processing externally supplied BPF filter programs.
• Logs: System logs (e.g., /var/log/syslog, journalctl) showing segmentation fault signals or core dumps from libpcap-linked processes.
• File System: Presence of core dump files in the working directory of libpcap-using applications following unexpected termination.
• Network: Unusual or malformed BPF filter programs being passed to packet capture tools, especially those lacking a return instruction or containing extreme jump offsets.

Upgrade libpcap to version 1.10.7 or later, which includes the fix that adds proper program length validation to pcapint_filter_with_aux_data() (libpcap commit). As a workaround where upgrading is not immediately possible, restrict local user access to applications that accept externally supplied BPF filter programs, and validate BPF filter programs using pcap_setfilter() (which invokes the validator) before passing them to pcap_offline_filter(). Avoid use of the deprecated bpf_filter() function, which cannot safely determine program length. Monitor for unexpected crashes in libpcap-linked processes (GitHub Advisory).