CVE-2026-18238: CWE-1288: Improper Validation of Consistency within Input in The Tcpdump Group libpcap

The vulnerability exists in the rpcap client code of libpcap where it incorrectly validates the headers of RPCAP_MSG_PACKET messages received from the server. A malicious server can exploit this by sending a crafted message that causes the client to read up to 20 bytes beyond the intended buffer boundary, treating this memory as part of the captured packet data. This improper validation leads to an information disclosure risk by exposing client process memory beyond the buffer.

An attacker controlling a malicious RPCAP server can exploit this vulnerability to cause the client to read and potentially disclose up to 20 bytes of memory beyond the packet buffer. This results in limited information disclosure (confidentiality impact) without affecting integrity or availability. The CVSS 3.1 score is 5.0 (medium severity), reflecting the network attack vector with low complexity and requiring low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor The Tcpdump Group advisories for updates and apply any forthcoming patches promptly. Until then, avoid connecting rpcap clients to untrusted or malicious servers.