CVE-2026-13587: PcapPlusPlus Buffer Overflow Vulnerability

CVE-2026-13587 Overview

CVE-2026-13587 is a heap-based buffer overflow in seladb PcapPlusPlus 25.05, specifically within the parse_by_block_type function of light_pcapng.c in the LightPcapNg Parser component. The flaw is triggered by manipulation of the captured_packet_length argument during pcapng block parsing. The attack can be initiated remotely, but exploitation complexity is rated high and practical exploitability is described as difficult. A public proof-of-concept has been released, increasing the likelihood of experimentation by researchers and threat actors. The weakness is classified under CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer.

Critical Impact
A crafted pcapng capture file processed by an application linked against PcapPlusPlus 25.05 can trigger a heap-based buffer overflow, leading to potential availability impact on the parser process.

Affected Products

seladb PcapPlusPlus 25.05
Applications embedding the LightPcapNg Parser component (light_pcapng.c)
Downstream tooling that ingests pcapng files via PcapPlusPlus

Discovery Timeline

2026-06-29 - CVE-2026-13587 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-13587

Vulnerability Analysis

The vulnerability resides in parse_by_block_type inside light_pcapng.c, part of the LightPcapNg Parser used by PcapPlusPlus. The parser processes pcapng block structures that include a captured_packet_length field controlled by the input file. When this length value is manipulated, the parser writes past the bounds of a heap-allocated buffer intended to hold packet data. This condition matches the [CWE-119] category of improper memory bounds enforcement. The public proof-of-concept, distributed as poc.zip, demonstrates that a malformed pcapng file is sufficient to reach the vulnerable code path without authentication or user interaction beyond loading the file.

Root Cause

The root cause is missing or insufficient validation of the captured_packet_length field against the actual allocated buffer size before the parser copies packet bytes into memory. The value is trusted from attacker-controlled input, which allows the copy operation to overflow the heap chunk backing the packet buffer.

Attack Vector

The attack vector is network-adjacent through file delivery. An attacker crafts a pcapng file containing a manipulated captured_packet_length value and delivers it to a target that parses the file using PcapPlusPlus 25.05. Exploitation does not require privileges or user credentials, but the high attack complexity and difficult exploitability rating indicate that reliable code execution is non-trivial. The most likely observable outcome is process instability or crash of the parsing application.

No verified exploit code is reproduced here. See GitHub Issue #2149 and the GitHub PoC Attachment for the public proof-of-concept and reproduction details.

Detection Methods for CVE-2026-13587

Indicators of Compromise

Unexpected crashes or segmentation faults in processes or services that ingest pcapng files via PcapPlusPlus 25.05.
pcapng files with anomalously large or inconsistent captured_packet_length values relative to their enclosing Enhanced Packet Block size.
Files sourced from untrusted origins matching the structure demonstrated in the public poc.zip artifact.

Detection Strategies

Perform static validation of pcapng inputs, rejecting blocks where captured_packet_length exceeds the declared block length or file bounds.
Run PcapPlusPlus-based parsers under AddressSanitizer (ASan) in test environments to surface heap overflows during file ingestion.
Monitor endpoint telemetry for abnormal termination of tools and services that consume pcapng captures, correlated with recent file arrivals.

Monitoring Recommendations

Log the source, hash, and size of all pcapng files processed by production analysis pipelines.
Alert on repeated parser crashes originating from the same file hash or upload source.
Track network security tooling that embeds PcapPlusPlus and flag versions matching 25.05.

How to Mitigate CVE-2026-13587

Immediate Actions Required

Inventory all internal tools, sensors, and forensic utilities that statically or dynamically link against PcapPlusPlus 25.05.
Restrict pcapng ingestion to files from trusted sources until a fixed release is deployed.
Isolate parsing workloads in sandboxed or containerized environments with least privilege to contain any successful overflow.

Patch Information

At the time of publication, no fixed release version is listed in the NVD entry for CVE-2026-13587. Monitor the GitHub PcapPlusPlus Repository and GitHub Issue #2149 for upstream commits that address the parse_by_block_type bounds check. Additional tracking is available via VulDB CVE-2026-13587.

Workarounds

Disable or bypass the LightPcapNg code path where alternate pcapng parsers are available in the host application.
Pre-validate pcapng files with an independent tool that enforces block length and captured_packet_length consistency before handing files to PcapPlusPlus.
Run parsing tools as unprivileged users with resource limits and process supervision to detect and restart crashes quickly.

bash

# Configuration example: pre-validate pcapng files before parsing
# Reject files where declared capture length exceeds block payload size
capinfos -c untrusted.pcapng || { echo "invalid pcapng, rejecting"; exit 1; }