PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7936 Tcpdump CVE debrief

CVE-2016-7936 is a critical memory-corruption issue in tcpdump's UDP parsing path. NVD assigns CVSS 3.0 9.8 and CWE-119, and the supplied record indicates tcpdump versions through 4.8.1 are affected, with 4.9.0 as the fixed release. Because tcpdump may be used on untrusted capture files or live traffic, affected deployments should be treated as urgent to remediate.

Vendor
Tcpdump
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-28
Original CVE updated
2026-05-13
Advisory published
2017-01-28
Advisory updated
2026-05-13

Who should care

Security and operations teams that run tcpdump on servers, jump hosts, packet-capture appliances, forensic pipelines, or CI/test systems; distribution maintainers and vulnerability management teams responsible for packaged or backported fixes.

Technical summary

The vulnerability is a buffer overflow in print-udp.c:udp_print() within tcpdump's UDP parser. The supplied NVD data classifies it as CWE-119 and rates it CVSS v3.0 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating a remotely reachable, low-complexity memory corruption issue with potentially severe impact. The affected version range in the supplied record extends through tcpdump 4.8.1.

Defensive priority

Immediate

Recommended defensive actions

  • Upgrade tcpdump to 4.9.0 or a vendor package that explicitly backports the fix.
  • Verify installed tcpdump versions across endpoints, servers, appliances, and analysis systems; treat 4.8.1 and earlier as affected unless a vendor advisory says otherwise.
  • Apply the relevant vendor or distribution advisories referenced in the CVE record, including Debian, Red Hat, and Gentoo packages where applicable.
  • Prioritize systems that process untrusted packet captures or traffic for faster remediation.
  • Document the remediation status in vulnerability tracking so the issue is not left open after package updates.

Evidence notes

The supplied NVD record states that tcpdump versions through 4.8.1 are vulnerable and maps the issue to CWE-119. The description identifies the flaw as a buffer overflow in print-udp.c:udp_print(), and the CVSS vector is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No Known Exploited Vulnerabilities entry was supplied.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-7936 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-7936

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-7936 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-7936

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.