PT-2026-5363 · Tcpflow · Tcpflow

Mobasi-Team · Published 2026-01-29 · Updated 2026-01-30 · CVE-2026-25061

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions tcpflow versions up to and including 1.61

Description tcpflow is a TCP/IP packet demultiplexer. The software parses 802.11 management frame elements and performs a length check on an incorrect field when handling the TIM (Timing Advertisement) element. A specially crafted frame with a large TIM length can cause a 1-byte out-of-bounds write past tim.bitmap[251]. The overflow is small, and a denial-of-service (DoS) attack is the likely impact, although code execution is possible. The affected structure is allocated on the stack within the handle beacon() function and related handlers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2026-25061

GHSA-Q5Q6-FRRV-9RJ6

Affected Products

Tcpflow

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25061.json · Exploit
• https://github.com/simsong/tcpflow/security/advisories/GHSA-q5q6-frrv-9rj6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25061 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25061 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25061 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-25061 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25061 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-25061 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-25061 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2017070492021072337 · Twitter Post
• https://twitter.com/CVEnew/status/2017000652367438232 · Twitter Post
• https://lists.debian.org/debian-lts-announce/2026/02/msg00014.html · Note