The vulnerability is an out‑of‑bounds read in tcpflow's TCP demultiplexer that results in the ability to read adjacent process memory when packets with forged IP payload lengths are processed. An unauthenticated attacker can craft IPv4 or IPv6 packets containing an invalid payload length; when tcpflow parses these packets while reconstructing flows or reading a pcap, the out‑of‑bounds read can expose arbitrary data or trigger a crash. The leak is limited to the memory that resides adjacent to the demultiplexer buffer, but because the read may span user‑controlled data boundaries, sensitive information can be retrieved without authentication.

Affected are systems running simsong's tcpflow up to and including version 1.6.1. The vulnerability exists specifically in the source file tcpdemux.cpp and is triggered during the processing of captured traffic or pcap files. Any deployment that uses tcpflow 1.6.1 or earlier as a traffic analysis tool is at risk; newer releases beyond 1.6.1 are unmentioned in the advisory.

The CVSS score of 6.3 indicates a moderate severity, while the EPSS score is not available and the flaw is not listed in the CISA KEV catalog. Because no authentication is required to trigger the out‑of‑bounds read, a remote attacker can exploit the flaw by sending malicious packets to a system running tcpflow or by supplying a crafted pcap file. The attack vector therefore relies on network traffic or file ingestion, making the vulnerability exploitable in both remote and local threat scenarios.