CVE-2026-119600

MEDIUM 4.8

tcpflow through 1.6.1 Out-of-Bounds Read via TCP Demultiplexer Payload Length

CVSS Score

4.8

EPSS Score

0.0%

EPSS Percentile

0th

tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into reconstructed flow files or crash tcpflow.

CWE	CWE-130
Vendor	simsong
Product	tcpflow
Published	Oct 30, 2026

Stay Ahead of the Next One

Get instant alerts for simsong tcpflow

Be the first to know when new medium vulnerabilities affecting simsong tcpflow are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Affected Versions

simsong / tcpflow

0 ≤ 1.6.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/simsong/tcpflow/issues/279 github.com: https://github.com/simsong/tcpflow/blob/tcpflow-1.6.1/src/tcpdemux.cpp#L781 github.com: https://github.com/simsong/tcpflow/blob/tcpflow-1.6.1/src/tcpdemux.cpp#L747 hackmd.io: https://hackmd.io/@haindpwn/tcpflow-ip-payload-length-oob-read github.com: https://github.com/simsong/tcpflow vulncheck.com: https://www.vulncheck.com/advisories/tcpflow-through-1.6.1-out-of-bounds-read-via-tcp-demultiplexer-payload-length

Credits

HaiND from the Post and Telecommunication Institute of Technology