CVE-2016-7986: The GeoNetworking parser in tcpdump before 4.9.0 has a buffer overflow in print-geonet.c, multiple functions.

Security readout for executives and security teams

CVE-2016-7986 affects tcpdump before 4.9.0. A flaw in its GeoNetworking packet parser can trigger a buffer overflow when tcpdump parses crafted traffic or capture data. Business risk is highest where tcpdump is used on servers, sensors, SOC tooling, or by analysts handling untrusted packet captures. Systems with tcpdump installed before 4.9.0 are potentially exposed, especially network monitoring hosts, forensic workstations, packet capture pipelines, and administrators who inspect untrusted pcap files or live network traffic containing GeoNetworking data. Address during normal vulnerability remediation, with higher priority for security monitoring and forensic environments. There is no provided evidence of active exploitation, but vulnerable packet parsers can affect trusted operational tooling. Mitigation focus: Upgrade tcpdump to 4.9.0 or later where available.; Apply fixed tcpdump packages from Debian, Red Hat, Gentoo, or your OS vendor.; Avoid opening untrusted packet captures with vulnerable tcpdump versions..

Prepared

Jun 13, 2026, 10:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.