Description

The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. A local user without administrative privileges could use the Npcap driver to capture the traffic reaching the host, which discloses information belonging both to the host and to other systems on the same network segment, and to send arbitrary raw packets on that segment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.2",
  "pubDate": "2026-08-11T10:17:11.963Z",
  "pubdate": "2026-08-11T10:17:11.963Z",
  "executiveSummary": "The vulnerability resides in the Windows installer for Npcap, which deploys the Npcap driver while leaving its access restriction option configured to an insecure default value.\nConsequently, the driver interface is accessible to any authenticated local user on the host system, rather than being strictly restricted to users with administrative privileges.\nThis improper access control introduces significant security risks, enabling unprivileged local attackers to interact directly with the packet capture and injection driver.\nAn attacker with standard local access can leverage this exposure to sniff network traffic traversing the host and inject arbitrary raw packets onto the local network segment.\nThe impact includes unauthorized information disclosure affecting both the local host and other systems residing on the same network segment, as well as potential network-based attacks originating from the compromised host.\nExploitation requires local execution capabilities on the target Windows system but does not necessitate administrative privileges due to the weak default discretionary access control settings applied during installation.",
  "technicalDetails": "The root cause of the vulnerability stems from the Npcap Windows installer applying an overly permissive default access restriction configuration when instantiating the Npcap driver object.\nDuring the installation procedure, the security descriptor associated with the driver does not appropriately restrict interaction solely to the administrative security context, allowing standard users and low-privilege processes to open handles to the driver device.\nThe vulnerable component is the Npcap driver interface exposed to the local operating system environment.\nAuthentication requirements are minimal, requiring only standard local user authentication on the Windows host without requiring any elevated privileges.\nThe attack flow proceeds as follows: First, an unprivileged local user or a compromised low-privilege application obtains execution on the target Windows host. Second, the local process opens a handle to the Npcap driver device using standard device interaction APIs. Third, because the driver lacks proper access restrictions, the interaction succeeds. Fourth, the malicious process leverages the driver functionality to interface with the network stack. Finally, the attacker captures incoming and outgoing network traffic reaching the host or transmits arbitrary raw packets directly onto the physical network segment.\nThe post-exploitation impact includes the passive interception of sensitive plaintext or insufficiently encrypted network traffic belonging to the host and peer systems on the network segment, as well as active abuse via raw packet injection to facilitate local reconnaissance, man-in-the-middle conditions, or spoofing attacks."
}