CVE-2017-12994: The BGP parser in tcpdump before 4.9.2 has a buffer over-read in print-bgp.c:bgp_attr_print().

Security readout for executives and security teams

Tcpdump versions before 4.9.2 can mishandle BGP data and read past an internal buffer. For leadership, the concern is exposure on systems that inspect network traffic or packet captures, especially untrusted routing traffic. The supplied sources rate this critical, but they do not show active exploitation. Exposure is likely where tcpdump before 4.9.2 is installed, embedded, or packaged by operating systems, and where analysts or automated tooling parse BGP traffic or untrusted capture files. The bundle does not provide normalized affected CPEs, so asset inventory must rely on package and version checks. Treat this as a high-priority hygiene fix for network operations and security tooling. It is old and should already be remediated, but vulnerable packet-analysis systems can still create avoidable risk when handling untrusted traffic or captures. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-fixed package.; Apply relevant Debian, Gentoo, Apple, or Red Hat vendor updates where applicable.; Check vendor guidance for unsupported or embedded tcpdump copies..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.