libpcap rpcapd CVE-2026-18313

rpcapd must be compiled, running, and reachable on the network - it is an optional daemon not started by default. The attacker must possess valid rpcap client credentials sufficient to establish a session (CVSS PR:L); unauthenticated network access alone is insufficient to trigger the leak. Each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message leaks up to 65536 bytes, so even a single legitimate session causes slow leakage; malicious acceleration requires only the ability to send messages rapidly within an authenticated session. Platforms running rpcapd in production (e.g., network sensors, SOC infrastructure) are at higher risk than developer workstations where rpcapd is rarely enabled.

The vendor-assigned CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) is well-calibrated. PR:L reflects that an rpcap client session must be established - anonymous network probes cannot trigger the leak. Impact is limited to availability (A:L), as memory leaks gradually rather than causing an immediate crash, and no confidentiality or integrity impact exists. rpcapd is not a standard internet-facing service; it is typically deployed on controlled internal networks for forensic or monitoring purposes. The vulnerability exists even under legitimate use (normal clients trigger it), but malicious acceleration requires only the ability to send repeated filter messages. Not listed in CISA KEV and EPSS data is not provided; given the narrow deployment of rpcapd and the PR:L barrier, opportunistic mass exploitation is unlikely. Real-world risk is primarily insider or network-adjacent threat: an authorized but malicious rpcap user could exhaust daemon memory, disrupting remote capture sessions.

An attacker with valid rpcap client credentials connects to an exposed rpcapd instance and rapidly sends RPCAP_MSG_UPDATEFILTER_REQ messages in a loop, each causing the server to allocate up to 65536 bytes of heap memory that is never freed. Over minutes to hours of sustained sending, the rpcapd process exhausts available system memory, causing the daemon to crash or the OS to kill it, disrupting all legitimate remote capture sessions on that host.