CVE-2026-18313: rpcapd memory leak in libpcap before 1.10.7
rpcapd can allocate up to 65536 bytes per each RPCAPMSGUPDATEFILTERREQ or RPCAPMSGSTARTCAPREQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libpcapto a version that resolves this vulnerability.Fixed in 1.10.7
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the rpcapd component of libpcap before 1.10.7 are affected. Exposure requires rpcapd to accept client RPCAP messages.
What does an attacker need to do to exploit the leak?
An attacker needs client access to send RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ messages to rpcapd. Repeated messages can accelerate memory consumption.
Is the impact limited to malicious activity?
No. rpcapd leaks memory during normal use when processing the affected message types, while a malicious client can make the leak occur substantially faster.
What is the practical impact of successful exploitation?
The leak can consume available memory over time and degrade or interrupt rpcapd availability. The provided severity vector indicates no confidentiality or integrity impact.