{"id":"CVE-2025-11964","aliases":["EUVD-2025-205868","GHSA-53h7-g6w8-rxxc","UBUNTU-CVE-2025-11964"],"status":"published","title":"OOBW in utf_16le_to_utf_8_truncated() in libpcap","description":"On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.","severity":{"version":"3.1","score":1.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00122,"percentile":0.01977,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2025-12-31T00:58:19Z","modified":"2026-10-28T10:59:01Z","products":[{"vendor":"the tcpdump group","product":"libpcap"}],"references":[{"url":"https://github.com/the-tcpdump-group/libpcap/commit/7fabf607f2319a36a0bd78444247180acb838e69","tags":["patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11964","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-53h7-g6w8-rxxc"},{"url":"https://github.com/the-tcpdump-group/libpcap/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11964.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-11964","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11964","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-11964","title":"OOBW in utf_16le_to_utf_8_truncated() in libpcap","description":"On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.","status":"published","published":"2025-12-31T00:58:19.026Z","modified":"2026-01-02T14:38:10.106Z","cvss":[{"version":"3.1","score":1.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:32:50.872559Z"}],"euvd":[{"id":"EUVD-2025-205868","description":"On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.","status":"published","published":"2025-12-31T00:58:19Z","modified":"2026-01-02T14:38:10Z","cvss":[{"version":"3.1","score":1.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T19:48:59.455836Z"}],"ghsa":[{"id":"GHSA-53h7-g6w8-rxxc","title":"On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message...","description":"On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.","status":"published","published":"2025-12-31T03:30:34Z","modified":"2025-12-31T03:30:34Z","cvss":[{"version":"3.1","score":1.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:05:24.798125Z"}],"nvd":[{"id":"CVE-2025-11964","description":"On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.","status":"published","published":"2025-12-31T01:15:54.667Z","modified":"2026-06-17T08:31:29.813Z","cvss":[{"version":"3.1","score":1.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:11:54.323368Z"}],"osv":[{"id":"CVE-2025-11964","title":"OOBW in utf_16le_to_utf_8_truncated() in libpcap","description":"On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.","status":"published","published":"2025-12-31T00:58:19.026Z","modified":"2026-10-28T10:59:01.853768728Z","cvss":[{"version":"3.1","score":1.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:46.024537Z"},{"id":"UBUNTU-CVE-2025-11964","description":"On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le_to_utf_8_truncated() can write data beyond the end of the provided buffer.","status":"withdrawn","published":"2026-01-02T00:00:00Z","modified":"2026-01-06T08:47:50.476251Z","cvss":[{"version":"3.1","score":1.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T16:55:20.144818Z"}]}}