Heap Buffer Overflow Vulnerability in PcapPlusPlus: ArpLayer toString Function
Summary
OSV-2025-718: Heap-buffer-overflow in pcpp::ArpLayer::toString. Affects pcapplusplus versions >= 813f15b87f5e76a62d64360f8cbdf449c21316e4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PcapPlusPlus is an open-source C++ library designed for packet capture and network analysis. It provides a high-level API for working with various network protocols, making it easier for developers to create applications that require packet manipulation and analysis. The library is widely used in network security tools, traffic analysis applications, and educational projects. However, it has recently been identified to have a heap buffer overflow vulnerability in the ArpLayer::toString function, which could lead to potential exploitation if not addressed.
Vulnerability Detail
The vulnerability arises from a heap buffer overflow in the pcpp::ArpLayer::toString function. This issue was reported through OSS-Fuzz, indicating that the function can read beyond the allocated memory, leading to crashes or potential exploitation. The specific crash type is a 'Heap-buffer-overflow READ 2', which means that the application attempts to read data from an invalid memory location. If exploited, this vulnerability could allow an attacker to execute arbitrary code or cause a denial of service, impacting the stability and security of applications relying on PcapPlusPlus.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you may consider avoiding the use of the ArpLayer::toString function in your application until the vulnerability is patched. Additionally, implementing input validation and sanitization can help mitigate the risk of exploitation.
Conclusion
The heap buffer overflow vulnerability in the PcapPlusPlus library's ArpLayer::toString function poses a significant risk to applications utilizing this library. It is crucial for developers to update to the latest patched version and consider implementing workarounds to mitigate potential exploitation. Regular monitoring for vulnerabilities using tools like Vulert can enhance security and maintain application integrity.
See every vulnerability recorded for pcapplusplus →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory and leading to unpredictable behavior.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
If exploited, this vulnerability could allow attackers to execute arbitrary code, leading to unauthorized access, data breaches, or denial of service.
Yes, a patch is available. It is recommended to update to the latest version of PcapPlusPlus that addresses this vulnerability.
OSS-Fuzz is a service that provides continuous fuzzing for open-source software, helping to identify vulnerabilities and improve software security.
References
Related vulnerabilities
Recent vulnerabilities recorded for pcapplusplus.
