{"id":"CVE-2026-18238","summary":"OOBR in rpcap client in libpcap before 1.10.7","details":"The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers.  A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.","modified":"2026-09-17T18:26:47.444097580Z","published":"2026-09-05T18:51:57.956Z","related":["SUSE-SU-2026:4188-1","SUSE-SU-2026:4194-1","SUSE-SU-2026:4195-1","SUSE-SU-2026:4239-1","openSUSE-SU-2026:11744-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18238.json","cna_assigner":"Tcpdump","cwe_ids":["CWE-126","CWE-1288"]},"references":[{"type":"WEB","url":"https://github.com/the-tcpdump-group/libpcap/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18238.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18238"},{"type":"FIX","url":"https://github.com/the-tcpdump-group/libpcap/commit/b9590d482986d64673712460aae1d48d11fa0473"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/the-tcpdump-group/libpcap","events":[{"introduced":"8c6c412779eb5bc57c9d07fe5a25f8046088bef5"},{"introduced":"b525001719c0d86e191eabf55ba6fc37410868df"},{"fixed":"b9590d482986d64673712460aae1d48d11fa0473"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"1.10.x"},{"fixed":"1.10.7"},{"introduced":"1.8.x"},{"last_affected":"1.8.x"},{"introduced":"1.9.x"},{"last_affected":"1.9.x"}]}}],"versions":["1.8.x","1.9.x","libpcap-1.10.6","libpcap-1.10.5","libpcap-1.10.4","libpcap-1.10.3","libpcap-1.10.2","libpcap-1.10.1","libpcap-1.10.0","libpcap-1.10-bp"],"database_specific":{"vanir_signatures_modified":"2026-09-10T08:43:22Z","vanir_signatures":[{"id":"CVE-2026-18238-db986c02","signature_type":"Line","signature_version":"v1","source":"https://github.com/the-tcpdump-group/libpcap/commit/b9590d482986d64673712460aae1d48d11fa0473","target":{"file":"pcap-rpcap.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["126745014859156597170614621204465156058","218597613164505883504880868951490854036","277760416231811665192849767967610927273","53344618212182480454950118483463134047","83514646262459458012393963778775620561","241495742656264761780296771817413171552","250566507824346273859099458314408372201","271988484295479431812989648605572404497","291170027153406805281659811874801754069","290907308318743163822168798396733168034","177516658885756521880055652369284343540","194543743159483846381647029229935554365","334141103402780794483865717572541375067","327301967465268138381245640582606733353","183401137400281466915968035573337447882","89421478822835578150333465545454037084","20116693824479223824992559727189101301","202039765029370326425408082099164003218","146564083540619483758126312190122886047","92808910859864952615949178407055801203","169081066414864028706749378398305097238","243620545696050923273756372870352561135","180935787735734477016708297653660523550","75314884897745422858252389114039161045","254796505908174017049263096088275283767","67893655826155657427097129228674332498","257886610074407865105670006751173006483","261725798918168466416210263288868567203","66415913402143365534597418282019908564","154902709817118890312287632636982765267","136158076944337027865683093637828644309","2138395587209252600556048585848512663","303584606457714897375071382386202726219","22181890563654218076959628529466091536","113718791891713192014666817640080453300","187715308447882770304711517480446144700","180593314917285409621058917690538071438","269128559997839209966229065566132007552","16428089002718277928847640121204230989","60510359930909960715201271172164981655","220709005679896494219577015448895698125","207860531315727163689983792157850077091","158612381709054856078504858544256471225","79652647659022518426653002540570126675","319590202620421201786948012702261030653","19368082744779985773257731778733812410","333719608260299406450873471905523116656","230990303691594343872125930416811981604","115419375084040079233903843871403845701","125595835850307141735903477035335728198","36463252912471265351404045112835477791"]}},{"source":"https://github.com/the-tcpdump-group/libpcap/commit/b9590d482986d64673712460aae1d48d11fa0473","target":{"file":"pcap-rpcap.c","function":"pcap_read_nocb_remote"},"deprecated":false,"digest":{"function_hash":"75135741058084599476705000039626859235","length":3124},"id":"CVE-2026-18238-ef79a71e","signature_type":"Function","signature_version":"v1"}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-18238.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"}]}