CVE-2017-11108: Tcpdump

High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days.

tcpdump 4.9.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packet data. The crash occurs in the EXTRACT_16BITS function, called from the stp_print function for the Spanning Tree Protocol.

Affected products

• Tcpdump Tcpdump: version 4.9.0 only

Published 2017-07-08. Last modified 2026-06-17.