What is the CVSS score of CVE-2026-25061?

CVE-2026-25061 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Tcpflow are affected by CVE-2026-25061?

CVE-2026-25061 is a high-severity vulnerability in tcpflow versions up to 1.61 that could allow attackers to crash or potentially execute code by crafting malicious 802.11 wireless packets.

Is there a public PoC exploit available for CVE-2026-25061?

Yes, a public proof-of-concept exploit is available for CVE-2026-25061. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-25061?

Within 24 hours: Identify all systems running tcpflow versions 1.61 and earlier; disable or isolate tcpflow services if not operationally critical. Within 7 days: Implement network segmentation to restrict which systems can send 802.11 management frames to tcpflow instances; deploy additional logging and monitoring for suspicious packet patterns. Within 30 days: Monitor vendor advisories for patch availability; evaluate alternative packet analysis tools; conduct incident response tabletop for potential compromise scenarios.

Tcpflow CVE-2026-25061

HIGH

Out-of-bounds Write (CWE-787)

2026-01-29 security-advisories@github.com

Denial Of Service Tcpflow Debian Linux Suse

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

PoC Detected

Feb 25, 2026 - 15:24 vuln.today

Public exploit code

CVE Published

Jan 29, 2026 - 22:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

tcpflow is a TCP/IP packet demultiplexer. In versions up to and including 1.61, wifipcap parses 802.11 management frame elements and performs a length check on the wrong field when handling the TIM element. A crafted frame with a large TIM length can cause a 1-byte out-of-bounds write past tim.bitmap[251]. The overflow is small and DoS is the likely impact; code execution is potential, but still up in the air. The affected structure is stack-allocated in handle_beacon() and related handlers. As of time of publication, no known patches are available.

AnalysisAI

Denial-of-service attacks against tcpflow up to version 1.61 are possible via malformed 802.11 management frames that trigger a stack-based buffer overflow in TIM element parsing. An unauthenticated remote attacker can craft a specially designed wireless frame to cause a one-byte out-of-bounds write, crashing the application or potentially executing arbitrary code. Public exploit code exists, but no patches are currently available for affected Debian Linux systems and other distributions using vulnerable tcpflow versions.

Technical ContextAI

Classified as CWE-787 (Out-of-bounds Write). Affects Tcpflow. tcpflow is a TCP/IP packet demultiplexer. In versions up to and including 1.61, wifipcap parses 802.11 management frame elements and performs a length check on the wrong field when handling the TIM element. A crafted frame with a large TIM length can cause a 1-byte out-of-bounds write past tim.bitmap[251]. The overflow is small and DoS is the likely impact; code execution is potential, but still up in the air. The affected structure is stack-allocated in handle_beacon() and related handlers.

RemediationAI

Monitor vendor advisories for a patch. Enable ASLR, DEP/NX, and stack canaries where possible. Restrict network access to the affected service where possible.