EUVD-2026-72021
GHSA-2xr5-28gv-34j3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Malicious server needs no privilege on the client system; scope changed as client reads beyond its buffer; impact limited to partial confidentiality only.
Primary rating from Vendor (Tcpdump).
CVSS VectorVendor: Tcpdump
Lifecycle Timeline
3DescriptionCVE.org
The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.
AnalysisAI
Remote memory disclosure in libpcap's rpcap client allows a malicious or compromised rpcap server to cause a connected client to read up to 20 bytes beyond the end of its receive buffer and treat that data as captured packet content. All libpcap versions with rpcap support are affected per CPE cpe:2.3:a:the_tcpdump_group:libpcap:*:*:*:*:*:*:*:*. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the libpcap client be actively using the rpcap remote packet capture protocol to stream packets from a remote server - this is a non-default, explicitly configured mode of operation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N, score 5.0) correctly characterizes this as a medium-severity, network-reachable information-disclosure issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix from the libpcap repository at commit b9590d482986d64673712460aae1d48d11fa0473 (https://github.com/the-tcpdump-group/libpcap/commit/b9590d482986d64673712460aae1d48d11fa0473). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unvalidated BPF scratch-register array index in libpcap's user-space BPF interpreter allows a local attacker with low pr
rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daem
Infinite-loop denial of service in libpcap's BPF interpreter allows a local low-privileged attacker to hang any process
Division by zero in libpcap's BPF interpreter can crash any application using the library when processing a crafted filt
Process termination via crafted BPF filter in libpcap allows a local attacker with low privileges to crash any applicati
Out-of-bounds memory reads in libpcap's userland BPF interpreter allow a local attacker who can supply a crafted filter
sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. Rated med
rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source. Rated medium seve
rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which
rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. Rated medium se
Remote packet capture support is disabled by default in libpcap. Rated medium severity (CVSS 4.4), this vulnerability is
Memory exhaustion in libpcap's rpcapd remote capture daemon allows an authenticated remote client to degrade or crash th
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today