A single-byte out‑of‑bounds write is performed by tcpflow’s wifipcap parser when processing the TIM element of 802.11 management frames. The vulnerable code performs a length check on the wrong field, writing beyond the bounds of a stack‑allocated bitmap. The overflow is small and is likely to cause a crash leading to a denial‑of‑service condition; the possibility of code execution cannot be ruled out but remains unverified. This weakness is a classic buffer overflow (CWE‑787).

The vulnerability affects Sim Song’s tcpflow up to and including version 1.61. The problem is present in the wifipcap module that parses Wi‑Fi traffic. Debian systems running tcpflow 1.61 or earlier are also impacted as they ship the vulnerable binary. No post‑1.61 releases have confirmed remediation.

The CVSS score of 5.5 indicates moderate impact, and the EPSS score of less than 1% shows a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to provide a crafted 802.11 management frame containing a TIM element with an inflated length to trigger the overflow. This requires the ability to inject frames into the wireless interface monitored by tcpflow, implying either a local attacker on the same networks or an attacker who has compromised the system running tcpflow. The attack vector is thus inferred to be a controlled network injection, not a generic remote exploit.