CVE-2017-13026: The ISO IS-IS parser in tcpdump before 4.9.2 has a buffer over-read in print-isoclns.c, several functions.

Security readout for executives and security teams

CVE-2017-13026 is a tcpdump parsing flaw. Older tcpdump releases before 4.9.2 can read past a buffer while decoding ISO IS-IS data. This matters most on systems where tcpdump or automated packet analysis handles untrusted network traffic or packet captures. Exposure is likely on Linux, macOS, or appliance environments using tcpdump versions before 4.9.2, including vendor-packaged builds, especially where packet captures are collected or parsed from untrusted networks. Prioritize normal patching for systems that capture or analyze network traffic. Escalate if tcpdump is used in automated monitoring pipelines processing untrusted input. Current evidence does not support emergency response for active exploitation. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor-fixed backported package.; Apply relevant OS vendor updates from Debian, Gentoo, Apple, or Red Hat.; Avoid parsing untrusted packet captures with vulnerable tcpdump versions..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.