CVE-2026-25061: tcpflow Denial of Service Vulnerability

CVE-2026-25061 Overview

CVE-2026-25061 is an out-of-bounds write vulnerability affecting tcpflow, a TCP/IP packet demultiplexer. The vulnerability exists in the wifipcap component, which parses 802.11 management frame elements. When handling the TIM (Traffic Indication Map) element, the parser performs a length check on the wrong field, allowing a crafted frame with a large TIM length to cause a 1-byte out-of-bounds write past tim.bitmap[251].

Critical Impact

A crafted 802.11 management frame can trigger a stack-based out-of-bounds write, likely resulting in denial of service with potential for code execution.

Affected Products

• tcpflow versions up to and including 1.6.1
• Systems using wifipcap for 802.11 frame parsing

Discovery Timeline

• 2026-01-29 - CVE CVE-2026-25061 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-25061

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-Bounds Write). The root issue lies in improper bounds checking within the wifipcap module when parsing 802.11 management frames. Specifically, during the handling of beacon frames and related management frames, the TIM element parser validates the length using an incorrect field, creating a condition where the actual data length exceeds the allocated buffer size.

The affected data structure is stack-allocated within the handle_beacon() function and related handlers, meaning the overflow occurs on the stack. While the overflow is limited to 1 byte past tim.bitmap[251], stack-based overwrites can potentially corrupt adjacent stack variables, return addresses, or saved registers, depending on compiler optimizations and stack layout.

Root Cause

The vulnerability stems from a logic error in the length validation code for TIM elements in 802.11 management frames. The parser checks the wrong field when determining the length of incoming TIM data, allowing an attacker to provide a TIM element with a length value that exceeds the bounds of the statically sized tim.bitmap[252] array (indices 0-251).

Attack Vector

An attacker can exploit this vulnerability by crafting a malicious 802.11 management frame (such as a beacon frame) with a specially constructed TIM element containing an oversized length value. When tcpflow processes captured network traffic containing this malicious frame through the wifipcap parser, the out-of-bounds write is triggered.

The attack requires network access, as the vulnerability is triggered through processing of network packet captures. The most likely attack scenario involves an attacker broadcasting malicious beacon frames within wireless range, which are then captured and processed by a system running tcpflow with wifipcap functionality.

The vulnerability mechanism involves the TIM element parser incorrectly validating the length field before copying data into the stack-allocated bitmap array. For technical implementation details, see the GitHub Security Advisory.

Detection Methods for CVE-2026-25061

Indicators of Compromise

• Unexpected crashes or segmentation faults in tcpflow processes when processing 802.11 captures
• Abnormal 802.11 beacon frames with oversized TIM element lengths in network traffic
• Process termination or core dumps related to the handle_beacon() function

Detection Strategies

• Monitor tcpflow processes for unexpected termination or crash signals
• Implement network traffic analysis to identify malformed 802.11 management frames with abnormal TIM element sizes
• Deploy SentinelOne Singularity platform for real-time detection of memory corruption exploitation attempts

Monitoring Recommendations

• Enable crash reporting and core dump analysis for tcpflow deployments
• Implement logging for 802.11 frame parsing operations to detect anomalous TIM element sizes
• Configure SentinelOne agents to monitor for stack corruption and out-of-bounds memory access patterns

How to Mitigate CVE-2026-25061

Immediate Actions Required

• Discontinue processing of untrusted 802.11 packet captures until a patch is available
• Isolate systems running vulnerable tcpflow versions from untrusted wireless network environments
• Consider using alternative packet analysis tools that do not include the vulnerable wifipcap component

Patch Information

As of the publication date, no known patches are available for this vulnerability. Organizations should monitor the tcpflow GitHub repository for security updates and apply patches immediately when they become available.

Workarounds

• Avoid processing packet captures from untrusted sources containing 802.11 management frames
• If wifipcap functionality is not required, consider building tcpflow without 802.11 parsing support
• Implement network segmentation to limit exposure of systems running tcpflow to potentially malicious wireless traffic
• Run tcpflow in sandboxed or containerized environments to limit the impact of potential exploitation

# Example: Run tcpflow in a restricted environment using firejail
firejail --seccomp --net=none tcpflow -r capture.pcap