CVE-2026-13589

MEDIUM

seladb PcapPlusPlus Telnet Subnegotiation Packet TelnetLayer.cpp getSubCommand heap-based overflow

Title source: cna
STIX 2.1

Description

A vulnerability was identified in seladb PcapPlusPlus 25.05. This affects the function pcpp::TelnetLayer::getSubCommand of the file Packet++/src/TelnetLayer.cpp of the component Telnet Subnegotiation Packet Handler. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit is publicly available and might be used. The identifier of the patch is 98e671010bc7c87b95898c22ae289220ae92542b. It is recommended to apply a patch to fix this issue.

References (9)

Core 9
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-374592 | seladb PcapPlusPlus Telnet Subnegotiation Packet TelnetLayer.cpp getSubCommand heap-based overflow
https://vuldb.com/vuln/374592
Signature, Permissions Required signature permissions-required
VDB-374592 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/374592/cti
Third Party Advisory third-party-advisory
CVE-2026-13589 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-13589
Third Party Advisory third-party-advisory
Submit #844482 | PcapPlusPlus v25.05 Heap-based Buffer Overflow
https://vuldb.com/submit/844482

Scores

CVSS v3 5.6
EPSS 0.0056
EPSS Percentile 42.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-119 CWE-122
Status published
Products (1)
seladb/PcapPlusPlus 25.05
Published Jun 29, 2026
Tracked Since Jun 29, 2026