{"id":"CVE-2026-18238","summary":"OOBR in rpcap client in libpcap before 1.10.7","details":"The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers.  A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.","modified":"2026-09-06T03:45:48.583600469Z","published":"2026-09-05T18:51:57.956Z","database_specific":{"cna_assigner":"Tcpdump","cwe_ids":["CWE-126","CWE-1288"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18238.json","unresolved_ranges":[{"extracted_events":[{"introduced":"1.10.x"},{"fixed":"1.10.7"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/18xxx/CVE-2026-18238.json"},{"type":"WEB","url":"https://github.com/the-tcpdump-group/libpcap/"},{"type":"FIX","url":"https://github.com/the-tcpdump-group/libpcap/commit/b9590d482986d64673712460aae1d48d11fa0473"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18238"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/the-tcpdump-group/libpcap","events":[{"introduced":"b525001719c0d86e191eabf55ba6fc37410868df"},{"last_affected":"82001f32ed9e76b0515a19ee0cc5be28c8ee0541"}],"database_specific":{"extracted_events":[{"introduced":"1.8.x"},{"last_affected":"1.8.x"},{"introduced":"1.9.x"},{"last_affected":"1.9.x"}],"source":"AFFECTED_FIELD"}}],"versions":["1.8.x","1.9.x","libpcap-1.9-bp","libpcap-1.9.0-rc1","libpcap-1.8.1","libpcap-1.8.0-bp"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-18238.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"}]}