CVE-2026-33921: Npcap Information Disclosure Vulnerability

CVE-2026-33921 Overview

CVE-2026-33921 affects the Windows installer for Npcap, which deployed the driver with its access restriction option left at an insecure default. The configuration made the Npcap driver accessible to every local user of the host rather than restricting access to administrators. A local, non-administrative user can leverage the driver to capture network traffic reaching the host and to send arbitrary raw packets on the local network segment. The captured traffic can disclose information belonging to the host and to other systems sharing the same network segment. This weakness is categorized under CWE-1188: Insecure Default Initialization of Resource.

Critical Impact
Any local user without administrative privileges can capture network traffic and inject arbitrary raw packets on the local network segment, exposing sensitive data from the host and adjacent systems.

Affected Products

Npcap deployed via the Windows installer using the default access restriction configuration
Windows hosts where Npcap was installed without enabling administrator-only access
Applications bundling Npcap that rely on the installer's default settings

Discovery Timeline

2026-08-11 - CVE-2026-33921 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database
2026-08-11 - Nozomi Networks Security Advisory NN-2026:14-01 released

Technical Details for CVE-2026-33921

Vulnerability Analysis

Npcap is a Windows packet capture library that installs a kernel driver to provide raw network access to user-mode applications. The Windows installer exposes an option that restricts driver access to members of the Administrators group. The vulnerable deployment left this option at its insecure default, which permits any interactive local user to open a handle to the driver.

Once an unprivileged process opens the driver, it inherits packet capture and packet injection capabilities normally reserved for privileged tools. The user can enumerate adapters, place them in promiscuous mode, and observe frames traversing the segment. The same interface allows the user to craft and transmit arbitrary Layer 2 frames without validation of source addresses or protocol constraints.

The defect is a configuration and design flaw rather than a memory safety issue. The kernel driver itself enforces whatever access control list the installer applies at setup time.

Root Cause

The root cause is an insecure default initialization of the driver's access control settings during installation [CWE-1188]. The installer presented the restrictive option but did not select it by default, so administrators who accepted the standard configuration deployed the driver with permissive access.

Attack Vector

Exploitation requires local access to the Windows host with any valid, non-administrative user account. The attacker opens the Npcap driver device, binds to a network adapter, and either sniffs traffic or transmits crafted frames. No user interaction from other accounts is required, and no code execution outside standard packet capture APIs is needed. The attack surface is limited to the local network segment reachable by the compromised host.

See the Nozomi Networks Security Advisory for additional technical details.

Detection Methods for CVE-2026-33921

Indicators of Compromise

Non-administrative processes opening handles to the Npcap driver device object, typically \Device\NPCAP or the associated named device
Unexpected instances of packet capture utilities such as Wireshark.exe, dumpcap.exe, tshark.exe, or WinPcap-linked binaries running under standard user accounts
Network adapters transitioning to promiscuous mode outside of scheduled diagnostic activity

Detection Strategies

Audit the Npcap driver's access control list on installed hosts and flag configurations that grant access to Everyone, Users, or Authenticated Users
Monitor process creation events for packet capture binaries executed by non-administrative accounts
Correlate driver open events with the invoking user's group membership to identify unauthorized access

Monitoring Recommendations

Enable Windows Security auditing for object access on the Npcap device to log handle opens by user context
Ingest endpoint telemetry into a centralized data lake to hunt for anomalous packet capture activity across the fleet
Track outbound raw frames from workstations that have no legitimate need for Layer 2 injection

How to Mitigate CVE-2026-33921

Immediate Actions Required

Reinstall Npcap and select the "Restrict Npcap driver's access to Administrators only" option during setup
Inventory all hosts with Npcap installed and identify systems configured with the permissive default
Remove Npcap from systems where packet capture is not a required function

Patch Information

Refer to the Nozomi Networks Security Advisory NN-2026:14-01 for vendor guidance. Remediation requires reinstalling Npcap with the administrator-only access option enabled, as the vulnerability stems from installer configuration rather than a code defect in the driver itself.

Workarounds

Uninstall Npcap on hosts where packet capture functionality is not required by business applications
Restrict interactive logon rights on hosts running Npcap to trusted administrative personnel only
Deploy application control policies that prevent unauthorized packet capture tools from executing under standard user contexts