Description

Pcapng file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-19T23:16:21.693Z",
  "pubdate": "2026-08-19T23:16:21.693Z",
  "executiveSummary": "This vulnerability involves a denial of service condition residing within the pcapng file parser affecting specific software versions. The flaw allows an unauthenticated remote attacker to cause application crashes by supplying a maliciously crafted input file or packet capture stream. The impact is localized to availability, resulting in abnormal termination of the parsing process and potential service disruption for dependent network analysis workflows. The affected product ranges include versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. Exploitation requires the target application to process a specially crafted pcapng file provided by the attacker, either through direct user interaction or automated ingestion of malicious capture data. No elevated privileges or prior authentication are strictly required to trigger the underlying parsing failure, provided the malicious payload reaches the vulnerable parsing engine.",
  "technicalDetails": "The root cause of the vulnerability stems from improper handling of malformed or maliciously structured data blocks within the pcapng file parser component. When the affected versions parse a pcapng capture containing specific structural anomalies or corrupted header fields, the parsing logic fails to validate internal boundaries or length indicators adequately. This manifests as a memory management error or an out-of-bounds read/write condition, ultimately triggering an unhandled exception or assertion failure that forces the application to abort execution.\nThe attack flow begins when an attacker constructs a malformed pcapng file containing specifically engineered block types, option lengths, or interface description blocks designed to violate the expected format specifications. The attacker then delivers this file to the target system via standard operational channels, such as uploading the capture file through a web interface, transmitting it over a monitored network interface ingested by an automated daemon, or tricking a user into opening the file within a vulnerable analysis utility.\nUpon ingestion, the vulnerable component reads the malicious pcapng structure. As the parser iterates through the sections and blocks, it encounters the corrupted fields. Due to the absence of rigorous bounds checking and error handling during block deserialization, the parsing routines attempt to access invalid memory addresses or execute invalid pointer arithmetic. This corrupts internal program state or immediately triggers a segmentation fault, terminating the process.\nThe affected components are restricted to the pcapng file parsing routines within versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. Network exposure depends on how the parser is deployed; if exposed via a network service that automatically processes uploaded capture files, the attack surface is remote. If the parser is invoked locally via a command-line interface or GUI, local access or user interaction via social engineering is required. The post-exploitation impact is limited to denial of service, as arbitrary code execution is typically not achievable through this specific crash vector based on standard parser denial of service profiles."
}