CVE-2026-18238: RPCAP Client Buffer Overflow Vulnerability

CVE-2026-18238 Overview

CVE-2026-18238 is an out-of-bounds read vulnerability in the libpcap Remote Packet Capture (rpcap) client. The client code that processes RPCAP_MSG_PACKET messages received from a server fails to correctly validate message headers. A malicious rpcap server can send a crafted packet message that causes the client to treat up to 20 bytes of process memory beyond the end of the buffer as captured packet data. The flaw is classified as [CWE-126] Buffer Over-read and affects rpcap client deployments that connect to untrusted or attacker-controlled servers.

Critical Impact
A malicious rpcap server can leak up to 20 bytes of adjacent client process memory into captured packet output on each crafted message.

Affected Products

libpcap rpcap client (the-tcpdump-group/libpcap)
Applications that link against vulnerable libpcap versions and use rpcap remote capture
Downstream tools such as tcpdump when configured to connect to remote rpcap servers

Discovery Timeline

2026-09-05 - CVE-2026-18238 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-18238

Vulnerability Analysis

The rpcap protocol allows a client to receive captured packets from a remote capture server via RPCAP_MSG_PACKET messages. Each message carries a header describing the length of the captured data that follows. The vulnerable client code does not fully validate this header against the actual size of the received buffer.

When the header advertises a captured length that exceeds the true payload size by up to 20 bytes, the client reads past the end of its receive buffer. Those out-of-bounds bytes are then written into the packet capture output as if they were part of the captured frame. The exposed bytes can contain heap metadata, adjacent buffer contents, or other process state useful for follow-on attacks.

Root Cause

The root cause is missing bounds validation between the RPCAP_MSG_PACKET header fields and the number of bytes actually delivered by the network read. The client trusts the server-supplied length field and passes it to downstream capture handling without confirming the payload was fully received.

Attack Vector

Exploitation requires the victim to connect a vulnerable rpcap client to a malicious or compromised rpcap server. The server crafts a RPCAP_MSG_PACKET message with an inflated length field and short payload, triggering the over-read on the client. Attackers with the ability to intercept and modify rpcap traffic between a legitimate client and server can achieve the same result.

text

       Fix error return from memory allocation error.
     rpcap:
       CVE-2026-18313: Fix a memory leak in rpcapd.
+      CVE-2026-18238: Fix RPCAP_MSG_PACKET validation.
     Documentation:
       Remove list of OSes that support "ipv6-icmp"; all the ones we
         support appear to do so.

Source: libpcap commit b9590d4

Detection Methods for CVE-2026-18238

Indicators of Compromise

Outbound rpcap client connections (default TCP port 2002) to hosts outside sanctioned capture infrastructure.
Packet capture files containing frames whose recorded length exceeds the corresponding on-wire payload by a small number of bytes.
Unexpected tcpdump or third-party capture tool sessions initiated with a rpcap:// source URL.

Detection Strategies

Inventory hosts that ship or embed libpcap and identify those that call rpcap client APIs.
Inspect rpcap sessions in network telemetry for servers not owned by the organization.
Compare deployed libpcap versions against the upstream fixed release referenced in the patch commit.

Monitoring Recommendations

Alert on process launches of capture utilities with rpcap:// arguments or environment-defined remote sources.
Monitor egress firewall logs for connections to TCP 2002 from workstation subnets.
Track file integrity of libpcap shared objects on servers and monitoring appliances.

How to Mitigate CVE-2026-18238

Immediate Actions Required

Upgrade libpcap to the version that includes the fix from commit b9590d4 and rebuild or repackage any statically linked consumers.
Restrict rpcap client usage to trusted servers on trusted network segments.
Audit and disable rpcap-based remote capture where local capture is a viable alternative.

Patch Information

The fix is committed upstream to the-tcpdump-group/libpcap in commit b9590d482986d64673712460aae1d48d11fa0473, which adds header validation to RPCAP_MSG_PACKET processing. Refer to the libpcap security commit for the full patch and apply the next tagged release provided by your distribution.

Workarounds

Block outbound TCP 2002 at perimeter firewalls except from authorized capture hosts.
Terminate rpcap traffic inside an authenticated TLS tunnel or VPN between known endpoints.
Prefer local packet capture (pcap_open_live) over pcap_open with rpcap:// sources until patched.

bash

# Confirm installed libpcap version and locate binaries linking it
pcap-config --version
ldconfig -p | grep libpcap

# Example egress restriction limiting rpcap client traffic to a trusted server
iptables -A OUTPUT -p tcp --dport 2002 -d 10.10.20.5 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 2002 -j DROP