Executive brief
Npcap is a packet capture driver used by network analysis and security monitoring tools on Windows. The installer left the driver accessible to any local user instead of restricting access to administrators, allowing unprivileged users to eavesdrop on network traffic and send arbitrary packets—potentially exposing sensitive data from the host and other networked systems.
Technical details
The vulnerability is an insecure default configuration (CWE-1188) in the Windows Npcap installer. The driver's access control settings were left at a permissive default, allowing any local user to access the packet capture driver without administrative privileges. This requires local access but no additional user interaction or authentication bypass. An unprivileged attacker can leverage the Npcap driver to capture network traffic (disclosing traffic from the host and other systems on the network segment) and inject arbitrary raw packets onto the network segment. The vulnerability affects Arc versions before v2.7.0; patches are available in v2.7.0 and later.
Affected products
- Nozomi Networks Arc before v2.7.0
Timeline
- 2026-08-11: disclosed
- 2026-08-11: patched: Arc v2.7.0 includes the fix