CVE-2025-11964 | THREATINT

Description

On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.

PUBLISHED Reserved 2025-10-20 | Published 2025-12-31 | Updated 2025-12-31 | Assigner Tcpdump

LOW: 1.9CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

Problem types

CWE-787 Out-of-bounds Write

Product status

Default status

unaffected

1.10.0 (semver) before 1.10.6

affected

Credits

Aniruddhan Murali reporter

Noble Saji Mathews reporter

Mahmoud Alfadel reporter

Mei Nagappan reporter

Meng Xu reporter

References

github.com/...ommit/7fabf607f2319a36a0bd78444247180acb838e69 patch

cve.org (CVE-2025-11964)

nvd.nist.gov (CVE-2025-11964)

Download JSON