CVE-2023-7256: Double-free in libpcap before 1.10.5 with remote packet capture support.

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-31 · updated 2026-06-17
Weakness: CWE-415

Description

In affected libpcap versions during the setup of a remote packet capture the internal function sock_initaddress() calls getaddrinfo() and possibly freeaddrinfo(), but does not clearly indicate to the caller function whether freeaddrinfo() still remains to be called after the function returns. This makes it possible in some scenarios that both the function and its caller call freeaddrinfo() for the same allocated memory block. A similar problem was reported in Apple libpcap, to which Apple assigned CVE-2023-40400.

Affected products

The Tcpdump Group libpcap: before 1.10.5 — fixed in 1.10.5

How to fix

Upgrade to a fixed version: The Tcpdump Group libpcap 1.10.5. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-7256 or the next vulnerability affects your stack