CVE-2017-12895: The ICMP parser in tcpdump before 4.9.2 has a buffer over-read in print-icmp.c:icmp_print().

Security readout for executives and security teams

CVE-2017-12895 is a tcpdump flaw: versions before 4.9.2 can read past a buffer while decoding ICMP traffic. Business risk is highest where tcpdump or vendor systems using it inspect untrusted packets or capture files. The bundle rates it critical, but the public description is brief. Exposure is likely on Linux, Unix, macOS, appliances, or analyst workstations running tcpdump before 4.9.2 or vendor packages that include the vulnerable parser. Systems that process untrusted live traffic or packet captures deserve priority review. Prioritize remediation where packet capture is used in production, SOC, incident response, or embedded network tooling. The CVSS score is critical, but the evidence bundle is sparse; focus on fast patch verification rather than emergency claims of active exploitation. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-fixed package.; Apply relevant Gentoo, Debian, Apple, or Red Hat security updates.; Avoid analyzing untrusted captures with vulnerable tcpdump builds..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.