CVE-2020-12740: Broadcom Tcpreplay

Critical severity, CVSS 9.1. EPSS: 1.7% chance of exploitation in the next 30 days.

tcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-read during a get_c operation. The issue is being triggered in the function get_ipv6_next() at common/get.c.

Affected products

• Broadcom Tcpreplay: up to and including 4.3.2
• Fedoraproject Fedora: version 31 only; version 32 only

Published 2020-05-08. Last modified 2026-06-17.