SB2026072721 - Multiple vulnerabilities in Tcpreplay
Published: July 27, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Out-of-bounds read (CVE-ID: N/A)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to out-of-bounds read in tcpreplay and tcpreplay-edit default non-LIBXDP send path when replaying a crafted pcap file with the --pktlen and --preload-pcap options. A remote attacker can supply a specially crafted pcap file to disclose sensitive information.
The issue occurs because the cached packet buffer is sized from the captured length while the transmitted length is taken from the packet header length field. No special build configuration is required.
2) Out-of-bounds write (CVE-ID: N/A)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and potentially execute arbitrary code.
The vulnerability exists due to out-of-bounds write in ARP-rewriting routines in src/tcpedit/edit_packet.c when processing an attacker-supplied pcap file with IP rewrite or randomization options enabled. A remote attacker can trick the victim into processing a crafted pcap file to cause a denial of service and potentially execute arbitrary code.
User interaction is required to process the crafted pcap file, and exploitation was confirmed via tcpreplay/tcpreplay-edit with --preload-pcap enabled.
3) Stack-based buffer overflow (CVE-ID: N/A)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to stack-based buffer overflow in the tcpprep services file parser in parse_services() when parsing an attacker-supplied services file passed through the --services option. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.
User interaction is required to run tcpprep with the attacker-supplied services file.
Remediation
Install update from vendor's website.