CVE-2025-11964 LOW

CVE-2025-11964: OOBW in utf_16le_to_utf_8_truncated() in libpcap

Vendor The Tcpdump Group
Product libpcap
Weakness CWE-787
Published December 31, 2025
Last update January 2, 2026
View on NVD All CVEs

CVSS base score

1.9/10
Attack vector Local
Attack complexity High
Privileges required High
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.

Key dates

02Disclosure timeline

December 31, 2025 CVE published
January 2, 2026 Record updated