SZB-dec6cd0ebc
EUVD-2026-113937 reports out-of-bounds read in tcpflow through 1.6.1
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- simsong
- Product
- tcpflow
- First seen
Summary
The EUVD listing, citing a CVSS v3.1 score of 6.3, says tcpflow through 1.6.1 has an out-of-bounds read that lets unauthenticated attackers read process memory. The attack uses crafted IPv4 or IPv6 TCP packets sent into captured traffic.
If you use simsong
Check for a tcpflow release later than 1.6.1
Upgrade tcpflow once a fixed version is available
Avoid processing untrusted captured traffic until patched
What the sources say 1
· Mastodon: “tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths.” Source