CVE-2017-12899: The DECnet parser in tcpdump before 4.9.2 has a buffer over-read in print-decnet.c:decnet_print().

Security readout for executives and security teams

Tcpdump versions before 4.9.2 can read beyond intended memory while decoding DECnet traffic. Tcpdump is commonly present on servers, network tools, appliances, and analyst workstations, so exposure often depends on where packet captures are processed. Treat this as urgent where untrusted traffic or packet captures are inspected. Systems running tcpdump before 4.9.2, including OS packages and bundled copies in network tooling, are the relevant exposure. The bundle does not provide specific CPEs, so asset discovery should verify actual installed package versions and vendor backports. Prioritize remediation on systems that inspect external traffic, support incident response, or process third-party packet captures. The issue is old and fixed upstream, so remaining exposure likely reflects unmanaged assets, stale appliances, or outdated base images. Mitigation focus: Upgrade tcpdump to 4.9.2 or later where vendor packaging allows.; Apply fixed OS vendor packages from Debian, Gentoo, Apple, Red Hat, or relevant suppliers.; Restrict use of vulnerable tcpdump against untrusted traffic or packet captures until updated..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.