Executive brief
libpcap is a widely-used packet capture library that many network tools and security applications depend on. The rpcap remote capture client code fails to properly validate message headers from a rpcap server, allowing a malicious server to trick a client into reading up to 20 bytes of memory beyond the legitimate packet buffer. This can expose sensitive data or crash the client application.
Technical details
The vulnerability exists in the rpcap client code's handling of RPCAP_MSG_PACKET messages. The pcap_read_nocb_remote() function does not correctly validate that a complete RPCAP_MSG_PACKET header is present in the received message, and uses an incorrect length value to validate the declared message size. This allows a malicious rpcap server to send a crafted packet message that causes the client to over-read the buffer by up to 20 bytes, reading into adjacent process memory. The issue is network-reachable and requires only that the client connects to a malicious rpcap server. An integer overflow vulnerability in the UDP code path on 32-bit architectures is also mentioned. A fix is available in libpcap's repository.
Affected products
- tcpdump.org libpcap
Timeline
- 2026-09-05: disclosed
- 2026-09-05: patched