CVE-2016-7922: The AH parser in tcpdump before 4.9.0 has a buffer overflow in print-ah.c:ah_print().

Security readout for executives and security teams

CVE-2016-7922 is a buffer overflow in tcpdump’s parser for IPsec Authentication Header traffic. Systems running tcpdump before 4.9.0 may be affected when they inspect crafted traffic or packet captures. The source bundle does not show active exploitation or a CVSS score. Most exposed assets are network monitoring, troubleshooting, or security systems that run tcpdump on untrusted traffic. Workstations or servers are exposed if users analyze untrusted packet captures with vulnerable tcpdump versions. Treat this as a targeted patching issue for network operations and security tooling. Prioritize systems that continuously inspect untrusted traffic or run tcpdump with high privileges. Broad emergency action is not supported by the provided evidence. Mitigation focus: Upgrade tcpdump to 4.9.0 or a vendor-fixed package.; Use Debian, Red Hat, or Gentoo advisories for distribution-specific fixes.; Avoid processing untrusted packet captures with vulnerable tcpdump..

Prepared

Jun 13, 2026, 08:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.