tcpflow CVE-2026-119600

Exploitation requires that tcpflow (through 1.6.1) actually process attacker-influenced data: either the attacker can inject crafted IPv4/IPv6 TCP packets into network traffic that a tcpflow instance is live-capturing, or the attacker supplies a malicious pcap file that an operator runs tcpflow against. The specific trigger is a TCP packet whose IP payload-length field is forged to be inconsistent with the actual packet size, causing the demultiplexer (tcpdemux.cpp around lines 747/781) to read out of bounds. This matches the CVSS AT:P attack-requirement: the flaw is unauthenticated (PR:N) and needs no victim UI, but it is not self-triggering - someone must be running tcpflow over the attacker-reachable traffic or file. That dependency on an operator capturing/processing adversary data is the primary limiting factor; impact is further limited to leaking adjacent memory into output flow files or crashing the tool.

This is a medium-severity information-disclosure/denial issue, not a top-priority emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L) scores 6.3 and is internally consistent with the description: unauthenticated, low-complexity, but carrying an attack requirement (AT:P) - the attacker cannot act alone, they must get crafted packets into traffic that a tcpflow operator is capturing or into a pcap that gets processed. Impact is bounded: low confidentiality (adjacent process memory leaked into reconstructed flow files) and low availability (crash), with no integrity impact. No EPSS score was provided, so exploitation probability cannot be quantified. The vuln is NOT on CISA KEV, so there is no confirmed active exploitation, and the vuln.today priority is 'this_month' rather than act_now/emergency - consistent with a real-but-contained issue. A public PoC reference exists (the hackmd write-up) but it is not verified as working exploit code. The main risk driver is that tcpflow is a forensics/capture tool often pointed at untrusted or adversary-influenced traffic, which is exactly the AT:P precondition; however, the limited technical impact and niche deployment keep real-world risk modest. Net: patch on a normal cycle, not a drop-everything event.

An attacker who can place packets on a network segment being captured by tcpflow (or who supplies a crafted pcap to an analyst) sends IPv4/IPv6 TCP packets with forged IP payload-length fields. When tcpflow's TCP demultiplexer trusts the forged length, it reads past the real packet buffer, leaking adjacent process memory into the reconstructed flow output files or crashing the tool. A public PoC reference exists (hackmd write-up) but is not verified as working exploit code.