---
id: CVE-2026-119600
title: tcpflow through 1.6.1 Out-of-Bounds Read via TCP Demultiplexer Payload Length
summary: >-
  tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows
  unauthenticated attackers to read process memory by sending packets with
  forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP
  packets into…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-130
vendor: simsong
product: tcpflow
affected:
  - tcpflow <= 1.6.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-04T22:28:41.522672Z'
published: '2026-10-30'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T22:28:53.487Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119600'
references:
  - url: 'https://github.com/simsong/tcpflow/issues/279'
  - url: >-
      https://github.com/simsong/tcpflow/blob/tcpflow-1.6.1/src/tcpdemux.cpp#L781
  - url: >-
      https://github.com/simsong/tcpflow/blob/tcpflow-1.6.1/src/tcpdemux.cpp#L747
  - url: 'https://hackmd.io/@haindpwn/tcpflow-ip-payload-length-oob-read'
  - url: 'https://github.com/simsong/tcpflow'
  - url: >-
      https://www.vulncheck.com/advisories/tcpflow-through-1.6.1-out-of-bounds-read-via-tcp-demultiplexer-payload-length
    label: >-
      VulnCheck Advisory: tcpflow through 1.6.1 Out-of-Bounds Read via TCP
      Demultiplexer Payload Length
tags:
  - cve.org
epss: 0.00373
epssPercentile: 0.31463
ingestedAt: '2026-11-05T21:36:00.648Z'
---

## Overview

tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into reconstructed flow files or crash tcpflow.

## Affected

- `tcpflow <= 1.6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.