« Volver al listado

CVE-2025-11964

Estado: AplazadaBaja (1.9)—

On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Tcpdump — LibpcapAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-11964",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-11964",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-02T14:23:03.611964Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@tcpdump.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 1.9,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 0.5
      }
    ]
  },
  "affected": [
    {
      "source": "security@tcpdump.org",
      "affectedData": [
        {
          "repo": "https://github.com/the-tcpdump-group/libpcap/",
          "vendor": "The Tcpdump Group",
          "product": "libpcap",
          "versions": [
            {
              "status": "affected",
              "version": "1.10.0",
              "lessThan": "1.10.6",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "fmtutils.c"
          ],
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "utf_16le_to_utf_8_truncated()"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-12-31T01:15:54.667",
  "references": [
    {
      "url": "https://github.com/the-tcpdump-group/libpcap/commit/7fabf607f2319a36a0bd78444247180acb838e69",
      "source": "security@tcpdump.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@tcpdump.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer."
    },
    {
      "lang": "es",
      "value": "Solo en Windows, si libpcap necesita convertir un mensaje de error de Windows a UTF-8 y el mensaje incluye caracteres que UTF-8 representa usando 4 bytes, utf_16le_to_utf_8_truncated() puede escribir datos más allá del final del búfer proporcionado."
    }
  ],
  "lastModified": "2026-06-17T08:31:29.813",
  "sourceIdentifier": "security@tcpdump.org"
}