PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7937 Tcpdump CVE debrief

CVE-2016-7937 is a critical memory-corruption issue in tcpdump’s VAT parser. NVD describes it as a buffer overflow in print-udp.c:vat_print() affecting tcpdump versions through 4.8.1, with a CVSS 3.0 score of 9.8. The issue was publicly published on 2017-01-28 and later referenced by multiple vendor and distro advisories.

Vendor
Tcpdump
Product
Unknown
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-28
Original CVE updated
2026-05-13
Advisory published
2017-01-28
Advisory updated
2026-05-13

Who should care

Administrators, security teams, and developers who deploy or embed tcpdump 4.8.1 or earlier should care most. Systems that process untrusted packet captures or traffic with tcpdump tooling are the primary concern, especially where tcpdump is used operationally or in automated analysis pipelines.

Technical summary

NVD records the weakness as CWE-119 and identifies a buffer overflow in the VAT parser code path (print-udp.c:vat_print()). The affected version range is tcpdump up to and including 4.8.1, with the issue corrected in 4.9.0 or later per the CVE description. NVD’s CVSS vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a high-severity flaw with no privileges or user interaction required.

Defensive priority

High. This is a remotely reachable, low-complexity memory corruption issue with critical CVSS severity and full confidentiality, integrity, and availability impact in the published vector.

Recommended defensive actions

  • Upgrade tcpdump to 4.9.0 or later, or to a vendor-supported fixed package version.
  • Inventory hosts, containers, and appliances that include tcpdump 4.8.1 or earlier.
  • Prioritize patching systems that regularly analyze untrusted captures or network data.
  • Use vendor advisories to confirm fixed package versions for your distribution (for example Debian, Red Hat, or Gentoo).
  • If immediate upgrade is not possible, restrict access to tcpdump usage and reduce exposure to untrusted packet inputs.

Evidence notes

All core claims are supported by the supplied NVD record and references. The CVE description states the flaw is a buffer overflow in print-udp.c:vat_print() in tcpdump before 4.9.0. NVD lists affected versions through 4.8.1, CWE-119, and a CVSS 3.0 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The supplied references show downstream vendor and distro advisories from Debian, Red Hat, and Gentoo.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-7937 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-7937

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-7937 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-7937

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.