CVE-2016-7938: The ZeroMQ parser in tcpdump before 4.9.0 has an integer overflow in print-zeromq.c:zmtp1_print_frame().

Security readout for executives and security teams

CVE-2016-7938 is a flaw in tcpdump’s ZeroMQ packet parser before version 4.9.0. A specially formed packet capture or network traffic could trigger an integer overflow while tcpdump analyzes ZeroMQ data. The main business concern is disruption or unsafe behavior in systems where administrators or tools inspect untrusted traffic. Exposure is most likely on systems running tcpdump versions before 4.9.0 that inspect live traffic or packet capture files containing ZeroMQ/ZMTP frames. Servers merely having tcpdump installed but not used on untrusted traffic have lower practical exposure. Prioritize remediation on security monitoring, network troubleshooting, and forensic systems that process untrusted packet data. This is not marked as known exploited, but tcpdump often runs in privileged operational contexts, making timely patching prudent. Mitigation focus: Upgrade tcpdump to version 4.9.0 or later where available.; Apply the relevant Debian, Red Hat, or Gentoo security update.; If immediate patching is unavailable, avoid analyzing untrusted packet captures with affected tcpdump..

Prepared

Jun 13, 2026, 09:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.