CVE-2026-25061

Name	CVE-2026-25061
Description	tcpflow is a TCP/IP packet demultiplexer. In versions up to and including 1.61, wifipcap parses 802.11 management frame elements and performs a length check on the wrong field when handling the TIM element. A crafted frame with a large TIM length can cause a 1-byte out-of-bounds write past `tim.bitmap[251]`. The overflow is small and DoS is the likely impact; code execution is potential, but still up in the air. The affected structure is stack-allocated in `handle_beacon()` and related handlers. As of time of publication, no known patches are available.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1126695

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
tcpflow (PTS)	bullseye	1.5.2+repack1-1	vulnerable
	bookworm	1.6.1-2	vulnerable
	forky, sid, trixie	1.6.1-3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
tcpflow	source	(unstable)	(unfixed)			1126695

Notes

[trixie] - tcpflow <no-dsa> (Minor issue)
[bookworm] - tcpflow <no-dsa> (Minor issue)
https://github.com/simsong/tcpflow/security/advisories/GHSA-q5q6-frrv-9rj6
https://github.com/simsong/tcpflow/commit/1d84fe8d59bb52c9a9da446a0fe6a31b2de15612