A buffer overflow occurs in the getradiotapfield() function of the hcxpcapngtool component within ZerBea hcxtools. The flaw arises from inadequate bounds checking and is classified as CWE‑120. An attacker with local access to the system can trigger the overflow by providing a crafted capture file, enabling the reading of memory beyond the intended buffer and exposing sensitive data such as configuration details or potentially confidential network traffic metadata. The vulnerability does not provide direct execution of arbitrary code or privilege escalation, but the information revealed could be used for further attacks.

The affected product is ZerBea hcxtools version 7.0.1‑43‑g2ee308e. No other vendors or product variants are listed as impacted, and earlier or later releases are presumed not to contain the same defect unless they retain the vulnerable code path.

The CVSS score of 6.2 reflects a medium severity impact, while the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not present in CISA’s KEV catalog. Exploitation requires local presence on the host where the tool is installed, and typically involves the creation or manipulation of a capture file that triggers the overflow. Even with a low probability of exploitation, the information exposure justifies prompt remediation.