Skip to main content

libpcap rpcapd EUVDEUVD-2026-72020

| CVE-2026-18313 MEDIUM
Memory Leak (CWE-401)
2026-09-05 Tcpdump GHSA-f2rh-ff9r-fh4j
4.3
CVSS 3.1 · Vendor: Tcpdump
Share

Severity by source

Vendor (Tcpdump) PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
vuln.today AI
4.3 MEDIUM

Network-reachable but requires an authenticated rpcap session (PR:L); impact is availability-only memory exhaustion with no confidentiality or integrity effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
4.3 MEDIUM
qualitative

Primary rating from Vendor (Tcpdump).

CVSS VectorVendor: Tcpdump

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low

Lifecycle Timeline

3
Metadata Corrected
Sep 05, 2026 - 19:40 vuln.today
tag: Information Disclosure replaced by Denial Of Service
Source Code Evidence Fetched
Sep 05, 2026 - 19:18 vuln.today
Analysis Generated
Sep 05, 2026 - 19:18 vuln.today

DescriptionCVE.org

rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.

AnalysisAI

Memory exhaustion in libpcap's rpcapd remote capture daemon allows an authenticated remote client to degrade or crash the service by triggering unreleased heap allocations. The daemon allocates up to 65536 bytes per RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message processed in daemon_unpackapplyfilter(), but the bf_insns BPF filter instruction array is never freed on any code path - success or error - under the pre-patch logic. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden

Vulnerability AssessmentAI

Exploitation rpcapd must be compiled, running, and reachable on the network - it is an optional daemon not started by default. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-assigned CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) is well-calibrated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply the upstream fix available at https://github.com/the-tcpdump-group/libpcap/commit/f9775af1a0ec76db60c7213241e6b48f1be10ac7, which restructures daemon_unpackapplyfilter() to release bf_prog.bf_insns on all exit paths. … Detailed patch versions, workarounds, and compensating controls in full report.

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-0799 HIGH
8.7 Sep 05

Unvalidated BPF scratch-register array index in libpcap's user-space BPF interpreter allows a local attacker with low pr

CVE-2019-15163 HIGH
7.5 Oct 03

rpcapd/daemon.c in libpcap before 1.9.1 allows attackers to cause a denial of service (NULL pointer dereference and daem

CVE-2026-6554 MEDIUM
5.5 Sep 05

Infinite-loop denial of service in libpcap's BPF interpreter allows a local low-privileged attacker to hang any process

CVE-2026-6244 MEDIUM
5.5 Sep 05

Division by zero in libpcap's BPF interpreter can crash any application using the library when processing a crafted filt

CVE-2026-31911 MEDIUM
5.5 Sep 05

Process termination via crafted BPF filter in libpcap allows a local attacker with low privileges to crash any applicati

CVE-2026-31912 MEDIUM
5.5 Sep 05

Out-of-bounds memory reads in libpcap's userland BPF interpreter allow a local attacker who can supply a crafted filter

CVE-2019-15165 MEDIUM
5.3 Oct 03

sf-pcapng.c in libpcap before 1.9.1 does not properly validate the PHB header length before allocating memory. Rated med

CVE-2019-15164 MEDIUM
5.3 Oct 03

rpcapd/daemon.c in libpcap before 1.9.1 allows SSRF because a URL may be provided as a capture source. Rated medium seve

CVE-2019-15162 MEDIUM
5.3 Oct 03

rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which

CVE-2019-15161 MEDIUM
5.3 Oct 03

rpcapd/daemon.c in libpcap before 1.9.1 mishandles certain length values because of reuse of a variable. Rated medium se

CVE-2026-18238 MEDIUM
5.0 Sep 05

Remote memory disclosure in libpcap's rpcap client allows a malicious or compromised rpcap server to cause a connected c

CVE-2024-8006 MEDIUM
4.4 Aug 31

Remote packet capture support is disabled by default in libpcap. Rated medium severity (CVSS 4.4), this vulnerability is

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected
SUSE Linux Enterprise Micro 5.5 Affected

Share

EUVD-2026-72020 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy