The rpcap client in libpcap processes an RPCAP_MSG_PACKET message received from a server without fully validating its headers. The flaw allows a malicious server to craft a message that causes the client to read up to 20 bytes beyond the end of the allocated buffer, treating those bytes as captured packet data. This out-of-bounds read can expose portions of the client’s process memory and may lead to application instability or crashes, but the CVE description does not explicitly state that it enables arbitrary code execution.

The vulnerability affects all software that includes the libpcap rpcap client component built with versions prior to 1.10.7, including packet capture tools from the Tcpdump Group. Any installation that connects to an RPCAP server and uses a pre‑1.10.7 libpcap library is potentially impacted. The CVE description does not list additional operating environments or product variants.

With a CVSS score of 5, the flaw is rated moderate severity. There is no EPSS data available, and the vulnerability is not listed in the CISA KEV catalog. Because a remote attacker can send a crafted packet over the network directly to the rpcap client, the likely attack vector is remote network traffic. Exploitation requires the client to accept a connection from an adversary and process the malicious RPCAP message, so limiting network exposure or applying the vendor patch are the primary defenses.