CVE-2017-12992: The RIPng parser in tcpdump before 4.9.2 has a buffer over-read in print-ripng.c:ripng_print().

Security readout for executives and security teams

Tcpdump versions before 4.9.2 can mishandle RIPng packet data and read past the intended buffer. Business risk is highest where tcpdump or automated packet analysis processes untrusted network traffic. The source bundle rates this critical, but does not show active exploitation. Exposure is likely on systems running tcpdump before 4.9.2, especially monitoring hosts, incident-response workstations, or automation that parses untrusted packet captures or observed RIPng traffic. Prioritize patching on network monitoring and security operations systems. This is critical-rated, but the available sources do not establish active exploitation, so urgency should track actual tcpdump use and exposure to untrusted traffic. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-fixed package.; Apply relevant OS vendor security updates for affected platforms.; Limit parsing of untrusted packet captures until patched..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.