CVE-2026-18238

The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.

Database specific

{
    "cna_assigner":  "Tcpdump",
    "cwe_ids":  [
        "CWE-126",
        "CWE-1288"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18238.json"
}

References

Affected packages

Git / github.com/the-tcpdump-group/libpcap

Affected ranges

Type

GIT

Repo

https://github.com/the-tcpdump-group/libpcap

Events

Introduced

8c6c412779eb5bc57c9d07fe5a25f8046088bef5

Introduced

b525001719c0d86e191eabf55ba6fc37410868df

Fixed

b9590d482986d64673712460aae1d48d11fa0473

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "1.10.x"
        },
        {
            "fixed":  "1.10.7"
        },
        {
            "introduced":  "1.8.x"
        },
        {
            "last_affected":  "1.8.x"
        },
        {
            "introduced":  "1.9.x"
        },
        {
            "last_affected":  "1.9.x"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.8.x

1.9.x

libpcap-1.*

libpcap-1.10-bp

libpcap-1.10.0

libpcap-1.10.1

libpcap-1.10.2

libpcap-1.10.3

libpcap-1.10.4

libpcap-1.10.5

libpcap-1.10.6

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-18238.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "126745014859156597170614621204465156058",
                "218597613164505883504880868951490854036",
                "277760416231811665192849767967610927273",
                "53344618212182480454950118483463134047",
                "83514646262459458012393963778775620561",
                "241495742656264761780296771817413171552",
                "250566507824346273859099458314408372201",
                "271988484295479431812989648605572404497",
                "291170027153406805281659811874801754069",
                "290907308318743163822168798396733168034",
                "177516658885756521880055652369284343540",
                "194543743159483846381647029229935554365",
                "334141103402780794483865717572541375067",
                "327301967465268138381245640582606733353",
                "183401137400281466915968035573337447882",
                "89421478822835578150333465545454037084",
                "20116693824479223824992559727189101301",
                "202039765029370326425408082099164003218",
                "146564083540619483758126312190122886047",
                "92808910859864952615949178407055801203",
                "169081066414864028706749378398305097238",
                "243620545696050923273756372870352561135",
                "180935787735734477016708297653660523550",
                "75314884897745422858252389114039161045",
                "254796505908174017049263096088275283767",
                "67893655826155657427097129228674332498",
                "257886610074407865105670006751173006483",
                "261725798918168466416210263288868567203",
                "66415913402143365534597418282019908564",
                "154902709817118890312287632636982765267",
                "136158076944337027865683093637828644309",
                "2138395587209252600556048585848512663",
                "303584606457714897375071382386202726219",
                "22181890563654218076959628529466091536",
                "113718791891713192014666817640080453300",
                "187715308447882770304711517480446144700",
                "180593314917285409621058917690538071438",
                "269128559997839209966229065566132007552",
                "16428089002718277928847640121204230989",
                "60510359930909960715201271172164981655",
                "220709005679896494219577015448895698125",
                "207860531315727163689983792157850077091",
                "158612381709054856078504858544256471225",
                "79652647659022518426653002540570126675",
                "319590202620421201786948012702261030653",
                "19368082744779985773257731778733812410",
                "333719608260299406450873471905523116656",
                "230990303691594343872125930416811981604",
                "115419375084040079233903843871403845701",
                "125595835850307141735903477035335728198",
                "36463252912471265351404045112835477791"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-18238-db986c02",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/the-tcpdump-group/libpcap/commit/b9590d482986d64673712460aae1d48d11fa0473",
        "target":  {
            "file":  "pcap-rpcap.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "75135741058084599476705000039626859235",
            "length":  3124
        },
        "id":  "CVE-2026-18238-ef79a71e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/the-tcpdump-group/libpcap/commit/b9590d482986d64673712460aae1d48d11fa0473",
        "target":  {
            "file":  "pcap-rpcap.c",
            "function":  "pcap_read_nocb_remote"
        }
    }
]

vanir_signatures_modified

"2026-09-10T08:43:22Z"