CVE-2016-7923: The ARP parser in tcpdump before 4.9.0 has a buffer overflow in print-arp.c:arp_print().

Security readout for executives and security teams

CVE-2016-7923 is a tcpdump flaw in its ARP packet parser before version 4.9.0. A specially crafted ARP packet or capture could trigger a buffer overflow while tcpdump is parsing traffic. The sources do not provide CVSS, confirmed exploitation, or detailed impact, so urgency depends on where tcpdump is used. Systems with tcpdump versions earlier than 4.9.0 are the relevant exposure. Risk is higher where tcpdump analyzes untrusted packet captures or live traffic, especially on monitoring, troubleshooting, or network-security systems. Patch through normal vulnerability management, with priority for network monitoring and incident response systems. There is no cited evidence of active exploitation, but the bug affects a privileged packet-analysis tool and has vendor fixes available. Mitigation focus: Upgrade tcpdump to version 4.9.0 or later.; Apply fixed tcpdump packages from Debian, Red Hat, Gentoo, or your OS vendor.; Prioritize systems that inspect untrusted pcaps or live network traffic..

Prepared

Jun 13, 2026, 08:21 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.