CVE-2025-11961CWE-122CWE-126

OOBR and OOBW in pcap_ether_aton() in libpcap

Low · published December 31, 2025

CVSS v3.1
1.9
EPSS
0%
Percentile
1.6
In the wild
Unconfirmed
What it is

pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a well-formed MAC-48 address in one of the supported formats, but this requirement has been poorly documented. If an application calls the function with an argument that deviates from the expected format, the function can read data beyond the end of the provided string and write data beyond the end of the allocated buffer.

The record
Technical detail
CVSS v3.1
1.9 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00117 · 1.6th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-126 · Buffer Over-read
Published
2025-12-31T00:56Z
EPSS history
Timeline
  • 31 DEC 00:56Z
    OOBR and OOBW in pcap_ether_aton() in libpcap
    cvelistv5