tcpreplay 4.5.1 PCAP File tcpliveplay.c do_checksum_math_liveplay heap-based overflow

Summaryinfo

A vulnerability, which was classified as critical, has been found in tcpreplay 4.5.1. This vulnerability affects the function do_checksum_math_liveplay of the file tcpliveplay.c of the component PCAP File Handler. This manipulation causes heap-based overflow. The identification of this vulnerability is CVE-2025-51005. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability has been found in tcpreplay 4.5.1 and classified as critical. Affected by this vulnerability is the function do_checksum_math_liveplay of the file tcpliveplay.c of the component PCAP File Handler. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect availability. The summary by CVE is:

A heap-buffer-overflow vulnerability exists in the tcpliveplay utility of the tcpreplay-4.5.1. When a crafted pcap file is processed, the program incorrectly handles memory in the checksum calculation logic at do_checksum_math_liveplay in tcpliveplay.c, leading to a possible denial of service.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-51005 since 06/16/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/29/2025).

The vulnerability scanner Nessus provides a plugin with the ID 266038 (Linux Distros Unpatched Vulnerability : CVE-2025-51005), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (266038). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• tcpreplay

Version

• 4.5.1

License

• open-source

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion