rpcapd can allocate up to 65536 bytes for each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from a client but never frees that memory. This results in a memory leak that persists even under normal use. A malicious client can repeatedly send such requests, causing the server to consume memory rapidly and potentially exhaust system memory, leading to degraded performance or crash. The weakness is a classic memory leak (CWE-401).

The Tcpdump Group's libpcap library, versions prior to 1.10.7, which provide the rpcapd service for remote packet capture. Any system running rpcapd with these older libpcap versions is impacted. No additional version details are supplied, so all releases before 1.10.7 are considered vulnerable.

The CVSS score of 4.3 indicates medium severity; however, the lack of an EPSS score means we cannot quantify the current exploitation likelihood. This vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The attack vector is remote: a client that speaks the rpcap protocol can trigger the memory leak by sending many update‑filter or start‑capture requests, especially if the service is exposed to untrusted networks.