CVE-2026-18238: OOBR in rpcap client in libpcap before 1.10.7
The rpcap client code that processes a RPCAPMSGPACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libpcapto a version that resolves this vulnerability.Fixed in 1.10.7
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the libpcap rpcap client are exposed when they receive RPCAP_MSG_PACKET messages from an untrusted or malicious rpcap server. The issue affects libpcap versions before 1.10.7.
What does an attacker need to exploit this issue?
An attacker needs to operate or control an rpcap server that the affected client connects to, and send a crafted RPCAP_MSG_PACKET message. No user interaction is required after the client is communicating with that server.
What is the practical impact?
The client can treat up to 20 bytes of process memory beyond the received buffer as captured-packet data. The reported impact is limited to disclosure of that memory as packet content; integrity and availability impacts are not indicated.
What should be done if patching is not immediately possible?
Avoid connecting affected rpcap clients to untrusted rpcap servers, and restrict rpcap server access to trusted endpoints until libpcap can be updated to 1.10.7 or later.