CVE-2026-13587
LowCVSS 3.7Summary
In PcapPlusPlus 25.05, the function parse_by_block_type in light_pcapng.c is vulnerable to a heap-based buffer overflow. An attacker can remotely exploit this by manipulating the captured_packet_length argument, though the attack complexity is high and exploitation is difficult.
Risk Assessment
Successful exploitation could lead to remote code execution or application crash, posing a risk to systems processing network traffic.
Recommendation
Immediately update PcapPlusPlus to the latest patched version and monitor publicly available exploits.
Other vulnerabilities in PcapPlusPlus
See all- CVE-2026-13589Medium
A heap-based buffer overflow vulnerability exists in PcapPlusPlus 25.05 in the pcpp::TelnetLayer::getSubCommand function of TelnetLayer.cpp. The attack can be initiated remotely but is difficult to exploit. A public exploit is available.
- CVE-2026-13588Medium
A heap-based buffer overflow vulnerability was found in PcapPlusPlus 25.05 in the function pcpp::SSLClientHelloMessage::getHandshakeVersion of SSLHandshake.cpp. An attacker can remotely manipulate the handshakeVersion argument, causing a buffer overflow. The attack complexity is high and exploitation is considered difficult, but the exploit has been publicly disclosed.
- CVE-2026-13590Medium
A security flaw in PcapPlusPlus 25.05 affects the pcpp::ModbusLayer::getLength function in ModbusLayer.h. Manipulating the length argument causes a heap-based buffer overflow, which can be exploited remotely.
Original NVD description (English source)
A vulnerability was found in seladb PcapPlusPlus 25.05. The affected element is the function parse_by_block_type of the file light_pcapng.c of the component LightPcapNg Parser. Performing a manipulation of the argument captured_packet_length results in heap-based buffer overflow. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been made public and could be used.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS