Search
Find a vulnerability
Search criteria
3 vulnerabilities by simsong
CVE-2026-119600 (GCVE-0-2026-119600)
Vulnerability from cvelistv5 – Published: 2026-10-30 13:18 – Updated: 2026-11-09 19:18
VLAI
EPSS
VEX
Title
tcpflow < 1.7.0 Out-of-Bounds Read via TCP Demultiplexer Payload Length
Summary
tcpflow before 1.7.0 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into reconstructed flow files or crash tcpflow.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 22:28 UTC
CWE
- CWE-130 - Improper Handling of Length Parameter Inconsistency
Assigner
VulnCheck
CNA
References
8 references
| URL | Tags |
|---|---|
| https://github.com/simsong/tcpflow/issues/279 | issue-tracking |
| https://github.com/simsong/tcpflow/blob/tcpflow-1… | technical-description |
| https://github.com/simsong/tcpflow/blob/tcpflow-1… | technical-description |
| https://hackmd.io/@haindpwn/tcpflow-ip-payload-le… | third-party-advisory |
| https://github.com/simsong/tcpflow | product |
| https://www.vulncheck.com/advisories/tcpflow-out-… | third-party-advisory |
| https://github.com/simsong/tcpflow/releases/tag/v1.7.0 | release-notespatch |
| https://github.com/simsong/tcpflow/pull/280 | issue-trackingpatch |
Impacted products
Date Public
2026-10-22 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119600",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T22:28:41.522672Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T22:28:53.487Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "tcpflow",
"repo": "https://github.com/simsong/tcpflow",
"vendor": "simsong",
"versions": [
{
"lessThanOrEqual": "1.6.1",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "1.7.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "tcpflow before 1.7.0 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into reconstructed flow files or crash tcpflow."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-130",
"description": "Improper Handling of Length Parameter Inconsistency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T19:18:39.240Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/simsong/tcpflow/issues/279"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/simsong/tcpflow/blob/tcpflow-1.6.1/src/tcpdemux.cpp#L781"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/simsong/tcpflow/blob/tcpflow-1.6.1/src/tcpdemux.cpp#L747"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haindpwn/tcpflow-ip-payload-length-oob-read"
},
{
"tags": [
"product"
],
"url": "https://github.com/simsong/tcpflow"
},
{
"name": "VulnCheck Advisory: tcpflow through 1.6.1 Out-of-Bounds Read via TCP Demultiplexer Payload Length",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/tcpflow-out-of-bounds-read-via-tcp-demultiplexer-payload-length"
},
{
"name": "Fixed Release Tag",
"tags": [
"release-notes",
"patch"
],
"url": "https://github.com/simsong/tcpflow/releases/tag/v1.7.0"
},
{
"name": "Pull Request",
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/simsong/tcpflow/pull/280"
}
],
"title": "tcpflow \u003c 1.7.0 Out-of-Bounds Read via TCP Demultiplexer Payload Length",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119600",
"datePublished": "2026-10-30T13:18:19.167Z",
"dateReserved": "2026-10-30T11:46:46.502Z",
"dateUpdated": "2026-11-09T19:18:39.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-25061 (GCVE-0-2026-25061)
Vulnerability from cvelistv5 – Published: 2026-01-29 21:42 – Updated: 2026-02-10 20:14
VLAI
EPSS
VEX
Title
tcpflow has TIM Element OOB Write in wifipcap
Summary
tcpflow is a TCP/IP packet demultiplexer. In versions up to and including 1.61, wifipcap parses 802.11 management frame elements and performs a length check on the wrong field when handling the TIM element. A crafted frame with a large TIM length can cause a 1-byte out-of-bounds write past `tim.bitmap[251]`. The overflow is small and DoS is the likely impact; code execution is potential, but still up in the air. The affected structure is stack-allocated in `handle_beacon()` and related handlers. As of time of publication, no known patches are available.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-30 14:47 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
GitHub_M
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/simsong/tcpflow/security/advis… | x_refsource_CONFIRM |
| https://lists.debian.org/debian-lts-announce/2026… |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-25061",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-30T14:47:54.181992Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T16:35:14.092Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-02-10T20:14:00.298Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00014.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "tcpflow",
"vendor": "simsong",
"versions": [
{
"status": "affected",
"version": "\u003c= 1.61"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "tcpflow is a TCP/IP packet demultiplexer. In versions up to and including 1.61, wifipcap parses 802.11 management frame elements and performs a length check on the wrong field when handling the TIM element. A crafted frame with a large TIM length can cause a 1-byte out-of-bounds write past `tim.bitmap[251]`. The overflow is small and DoS is the likely impact; code execution is potential, but still up in the air. The affected structure is stack-allocated in `handle_beacon()` and related handlers. As of time of publication, no known patches are available."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787: Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-29T21:42:47.013Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/simsong/tcpflow/security/advisories/GHSA-q5q6-frrv-9rj6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/simsong/tcpflow/security/advisories/GHSA-q5q6-frrv-9rj6"
}
],
"source": {
"advisory": "GHSA-q5q6-frrv-9rj6",
"discovery": "UNKNOWN"
},
"title": "tcpflow has TIM Element OOB Write in wifipcap"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-25061",
"datePublished": "2026-01-29T21:42:47.013Z",
"dateReserved": "2026-01-28T14:50:47.889Z",
"dateUpdated": "2026-02-10T20:14:00.298Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-24857 (GCVE-0-2026-24857)
Vulnerability from cvelistv5 – Published: 2026-01-28 21:30 – Updated: 2026-01-29 18:01
VLAI
EPSS
VEX
Title
bulk_extractor has Heap-based Buffer Overflow vulnerability
Summary
`bulk_extractor` is a digital forensics exploitation tool. Starting in version 1.4, `bulk_extractor`’s embedded unrar code has a heap‑buffer‑overflow in the RAR PPM LZ decoding path. A crafted RAR inside a disk image causes an out‑of‑bounds write in `Unpack::CopyString`, leading to a crash under ASAN (and likely a crash or memory corruption in production builds). There's potential for using this for RCE. As of time of publication, no known patches are available.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-29 16:03 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
GitHub_M
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/simsong/bulk_extractor/securit… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| simsong | bulk_extractor |
Affected:
>= 1.4, <= 2.1.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-24857",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-29T16:03:03.118001Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-01-29T18:01:12.601Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/simsong/bulk_extractor/security/advisories/GHSA-rh8m-9xrx-q64q"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "bulk_extractor",
"vendor": "simsong",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.4, \u003c= 2.1.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "`bulk_extractor` is a digital forensics exploitation tool. Starting in version 1.4, `bulk_extractor`\u2019s embedded unrar code has a heap\u2011buffer\u2011overflow in the RAR PPM LZ decoding path. A crafted RAR inside a disk image causes an out\u2011of\u2011bounds write in `Unpack::CopyString`, leading to a crash under ASAN (and likely a crash or memory corruption in production builds). There\u0027s potential for using this for RCE. As of time of publication, no known patches are available."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-28T21:30:35.410Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/simsong/bulk_extractor/security/advisories/GHSA-rh8m-9xrx-q64q",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/simsong/bulk_extractor/security/advisories/GHSA-rh8m-9xrx-q64q"
}
],
"source": {
"advisory": "GHSA-rh8m-9xrx-q64q",
"discovery": "UNKNOWN"
},
"title": "bulk_extractor has Heap-based Buffer Overflow vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-24857",
"datePublished": "2026-01-28T21:30:35.410Z",
"dateReserved": "2026-01-27T14:51:03.061Z",
"dateUpdated": "2026-01-29T18:01:12.601Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}