CVE-2016-7985: The CALM FAST parser in tcpdump before 4.9.0 has a buffer overflow in print-calm-fast.c:calm_fast_print().

Security readout for executives and security teams

CVE-2016-7985 is a buffer overflow in tcpdump’s CALM FAST packet parser before version 4.9.0. A specially crafted packet or capture file could trigger unsafe parsing when tcpdump inspects that protocol. The strongest business concern is disruption or unsafe behavior in systems and workflows that analyze untrusted network traffic. Exposure is most likely on systems running tcpdump before 4.9.0, especially packet capture sensors, analyst workstations, and automated jobs that parse untrusted traffic or capture files. Prioritize remediation in network monitoring and incident response environments. This is not currently evidenced as actively exploited, but tcpdump commonly handles attacker-controlled traffic, making timely vendor patching prudent. Mitigation focus: Upgrade tcpdump to 4.9.0 or a vendor-fixed package.; Apply relevant Debian, Red Hat, or Gentoo security updates where applicable.; Avoid opening untrusted packet captures with vulnerable tcpdump versions..

Prepared

Jun 13, 2026, 10:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.