CVE-2026-18238: the tcpdump group libpcap Buffer Over-read
CVSS: 5.0v3.1MediumAwaiting analysis
AliasesUBUNTU-CVE-2026-18238DEBIAN-CVE-2026-18238
Published 05-09-2026Last modified 08-09-2026
Vulnerability summary
CVE-2026-18238 is a medium (CVSS 5.0) Buffer Over-read vulnerability in the tcpdump group libpcap. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7% of scored vulnerabilities.
CVSS score
5.0/10
010
Medium · v3.1 (CVE.org)EPSS score
0.18%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 11 · Related 10Timeline
- 05-09-2026PublishedVulnerability first disclosed.
- 08-09-2026Last modifiedVulnerability information updated.
Description
The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end of the buffer as if it was a part of the captured packet.
CVSS metrics
4 scores · 4 sources · 1 versionMedium 5.0Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
- NVDNIST5.0MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
7%
Versus all other CVEs
30-day change
0.00 pp
From 0.18% on 20-09-2026
20-09-202620-10-2026
EPSS score0.18%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-126Buffer Over-readThe product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
- CWE-1288Improper Validation of Consistency within InputThe product receives a complex input with multiple elements or fields that must be consistent with each other, but it does not validate or incorrectly validates that the input is actually consistent.
Affected systems
Debian1 product
- libpcapAll versions (No fix recorded) | < 1.10.7-1
The tcpdump group1 product
- libpcap≥ 1.8.0, < 1.9.0 | ≥ 1.9.0, < 1.10.0 | ≥ 1.10.x, < 1.10.7
Ubuntu1 product
- libpcapAll versions (No fix recorded)
3 vendors · 3 products
