CVE-2025-11964

{"id": "CVE-2025-11964", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11964", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-02T14:23:03.611964Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@tcpdump.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 1.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.5}]}, "affected": [{"source": "security@tcpdump.org", "affectedData": [{"repo": "https://github.com/the-tcpdump-group/libpcap/", "vendor": "The Tcpdump Group", "product": "libpcap", "versions": [{"status": "affected", "version": "1.10.0", "lessThan": "1.10.6", "versionType": "semver"}], "programFiles": ["fmtutils.c"], "defaultStatus": "unaffected", "programRoutines": [{"name": "utf_16le_to_utf_8_truncated()"}]}]}], "published": "2025-12-31T01:15:54.667", "references": [{"url": "https://github.com/the-tcpdump-group/libpcap/commit/7fabf607f2319a36a0bd78444247180acb838e69", "source": "security@tcpdump.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@tcpdump.org", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer."}, {"lang": "es", "value": "Solo en Windows, si libpcap necesita convertir un mensaje de error de Windows a UTF-8 y el mensaje incluye caracteres que UTF-8 representa usando 4 bytes, utf_16le_to_utf_8_truncated() puede escribir datos m\u00e1s all\u00e1 del final del b\u00fafer proporcionado."}], "lastModified": "2026-06-17T08:31:29.813", "sourceIdentifier": "security@tcpdump.org"}