CVE-2026-18313
Received Received - Intake

Memory Leak in rpcapd Network Capture Service

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: Tcpdump Group

Description
rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memory substantially faster.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-18313
EUVD
EUVD-2026-72020

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
the-tcpdump-group libpcap From 0.9.0 (inc) to 1.10.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a memory leak in rpcapd, a component of libpcap. When processing certain RPCAP messages, rpcapd allocates up to 65536 bytes of memory but never frees it. A malicious client can repeatedly send these messages to cause the server to leak memory quickly, potentially leading to memory exhaustion.

Detection Guidance

Monitor memory usage on the system running rpcapd for unusual increases. Check for repeated allocation of large buffers (up to 65536 bytes) in network traffic involving RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ messages. Use tools like top, htop, or ps to observe memory consumption trends.

Impact Analysis

If you run a server using rpcapd, an attacker could exploit this to consume all available memory on the server, causing performance degradation or crashes. This could disrupt network monitoring or packet capture services relying on rpcapd.

Compliance Impact

This vulnerability causes memory exhaustion on the server due to unmanaged memory allocation in rpcapd. While not directly related to data privacy, memory exhaustion could lead to service disruptions or crashes, potentially impacting systems handling sensitive data. Compliance with GDPR or HIPAA may require maintaining system availability and integrity, which this vulnerability could undermine by causing resource depletion.

Mitigation Strategies

Apply the official patch from libpcap's repository to fix the memory leak in rpcapd. Restart the rpcapd service after applying the patch. If immediate patching is not possible, restrict access to rpcapd to trusted clients only to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18313. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart