CVE-2017-12902: The Zephyr parser in tcpdump before 4.9.2 has a buffer over-read in print-zephyr.c, several functions.

Security readout for executives and security teams

CVE-2017-12902 is a buffer over-read in tcpdump's Zephyr packet parser before version 4.9.2. A vulnerable tcpdump process could mishandle crafted network data while parsing Zephyr traffic. The CVSS score is critical, but the provided sources do not show known active exploitation. Exposure is most likely on systems running tcpdump before 4.9.2, especially monitoring hosts, servers, appliances, or administrator workstations that parse network traffic. The provided affected-product metadata is incomplete, so confirm exposure through local package inventory and vendor advisories. Treat this as high-priority patching for environments that use tcpdump operationally. The severity is critical, but business urgency depends on whether vulnerable tcpdump versions are present and actively parsing untrusted network traffic. Mitigation focus: Upgrade tcpdump to version 4.9.2 or later.; Apply fixed tcpdump packages from the operating system vendor.; Prioritize internet-facing or monitoring systems that parse untrusted traffic..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.