CVE-2026-119600 in tcpflow
Summary
by MITRE • 10/30/2026
tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into reconstructed flow files or crash tcpflow.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in tcpflow versions through 1.6.1 represents a critical security flaw rooted in improper input validation during the processing of network packet data. Specifically, this is an out-of-bounds read condition that occurs when the application processes TCP packets with forged or malformed IP payload length fields. The core technical failure lies in the software's inability to correctly bound-check the memory regions it accesses based on these header values. When tcpflow parses incoming traffic or pre-captured packet capture files, it relies on the declared lengths within the IPv4 and IPv6 headers to determine how much data to process and store. If an attacker supplies a payload length that exceeds the actual available buffer space or points beyond the allocated memory boundaries of the reconstruction logic, the application will read from adjacent memory locations rather than stopping at the intended limit. This behavior is characteristic of CWE-125, which defines out-of-bounds read vulnerabilities where software reads data past the end or before the beginning of a specified buffer.
The operational impact of this vulnerability is significant because it allows unauthenticated attackers to achieve information disclosure with minimal effort. By injecting crafted IPv4 or IPv6 TCP packets into captured traffic streams or by modifying existing pcap files, an attacker can force tcpflow to leak sensitive data from adjacent memory regions into the reconstructed flow output files. This leaked data may contain stack variables, heap metadata, or other process-specific information that could be leveraged for further exploitation attempts against the host system. Additionally, depending on the specific memory layout and the nature of the out-of-bounds access, this flaw can also lead to application instability, resulting in crashes or denial of service conditions where tcpflow becomes unresponsive due to segmentation faults or other fatal exceptions triggered by invalid memory accesses.
From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1059, specifically the sub-technique related to command and script interpreters if the leaked data facilitates further scripting attacks, though more directly it falls under information gathering techniques that exploit software vulnerabilities for reconnaissance. The ability to read arbitrary process memory is a precursor to more advanced exploitation strategies such as bypassing address space layout randomization or extracting cryptographic keys stored in memory. Because tcpflow operates at the network layer and often processes untrusted traffic from various sources, the attack surface is broad. An attacker does not need prior authentication to exploit this flaw; they simply need the ability to inject packets into a monitored stream or provide a malicious pcap file for analysis.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. The primary solution is to upgrade tcpflow to version 1.6.2 or later, where developers have implemented stricter bounds checking and validation of IP header fields before processing payload data. For environments where upgrading is not immediately feasible, network segmentation should be employed to restrict access to systems running vulnerable versions of the tool. Additionally, input sanitization at the perimeter can help filter out packets with anomalous length headers before they reach the application layer. Developers reviewing similar codebases should ensure that all buffer operations are accompanied by rigorous boundary checks and that error handling gracefully manages malformed inputs without exposing internal memory states. Regular security audits focusing on network parsing libraries are essential to prevent recurrence of such low-level memory safety issues.