CVE-2018-16452: The SMB parser in tcpdump before 4.9.3 has stack exhaustion in smbutil.c:smb_fdata() via recursion.

Security readout for executives and security teams

This is a denial-of-service flaw in tcpdump's SMB packet parser. A specially crafted SMB input can make vulnerable tcpdump versions recurse until the stack is exhausted, crashing the process. The business impact is loss or disruption of packet analysis, monitoring, or forensic workflows that rely on tcpdump, not data theft based on the provided sources. Exposure is most likely where tcpdump versions before 4.9.3 parse SMB traffic or packet captures from untrusted or uncontrolled sources. Downstream Linux distribution advisories show packaged tcpdump updates were issued. The provided CPE data is incomplete, so inventory should use installed package versions rather than CPE matching alone. Prioritize remediation in monitoring, SOC, network troubleshooting, and forensic environments. This is not presented as a data breach vulnerability, but it can disrupt visibility during incidents. Patch through normal security update channels, faster where tcpdump handles untrusted traffic or uploaded packet captures. Mitigation focus: Upgrade tcpdump to 4.9.3 or a vendor-patched package.; Apply relevant Debian, Fedora, openSUSE, Ubuntu, Apple, or appliance vendor security updates.; Limit tcpdump parsing of untrusted SMB captures until patched..

Prepared

May 24, 2026, 09:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.