CVE-2017-13687: The Cisco HDLC parser in tcpdump before 4.9.2 has a buffer over-read in print-chdlc.c:chdlc_print().

Security readout for executives and security teams

tcpdump versions before 4.9.2 can read past a buffer while decoding Cisco HDLC packets. This matters where tcpdump is used on production systems, monitoring hosts, appliances, or analyst workstations that inspect untrusted traffic or packet captures. Sources do not show active exploitation. Exposure is most likely on systems running tcpdump before 4.9.2, especially where users or automation parse Cisco HDLC traffic or untrusted capture files. The source bundle does not provide precise CPEs or a complete affected vendor list. Treat as a high-priority patching item for systems using tcpdump in monitoring or forensic workflows. The rating is critical, but urgency is highest where untrusted traffic or capture files are parsed before patching. Mitigation focus: Upgrade tcpdump to 4.9.2 or the vendor-fixed package.; Apply relevant OS vendor security updates where tcpdump is bundled.; Restrict tcpdump use to trusted captures until patched..

Prepared

May 22, 2026, 17:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.