CVE-2026-29976: 
NixOS vulnerability analysis and mitigation

CVE-2026-29976 is a global buffer overflow vulnerability in ZerBea's hcxpcapngtool (part of the hcxtools suite), specifically within the getradiotapfield() function in hcxpcapngtool.c. A local attacker can supply a crafted PCAP input file to trigger an out-of-bounds read on the global usedfrequency array, causing the application to crash. The affected version is hcxtools v7.0.1-43-g2ee308e. It was reported on January 23, 2026, and published to NVD on March 26, 2026. The CVSS v3.1 base score is 6.2 (Medium) (GitHub Issue, Feedly).

The root cause is a classic buffer overflow (CWE-120) — the program does not properly validate an internal index before accessing the global usedfrequency array (size 131,070 bytes), allowing a 2-byte read immediately past the array's end. The vulnerable call chain is: main() → processcapfile() → processcap() → processlinktype() → getradiotapfield() at line 4891 of hcxpcapngtool.c. Exploitation requires only that the attacker supply a crafted PCAP file as input to the tool — no credentials or user interaction beyond running the binary are needed. AddressSanitizer output confirms the overflow occurs 0 bytes after the usedfrequency global variable (GitHub Issue).

The primary confirmed impact is a Denial of Service (DoS) — the application crashes when processing a maliciously crafted PCAP file. The out-of-bounds read affects the global usedfrequency buffer, and while the original reporter noted a theoretical possibility of unauthorized data disclosure, no code execution or confirmed data exfiltration has been demonstrated. The scope is limited to the local system running hcxpcapngtool, with no evidence of lateral movement potential (GitHub Issue, Feedly).

A proof-of-concept is publicly available on GitHub, consisting of 17 crafted PCAP input files (mal_inputs.zip) that reliably crash the program (GitHub Issue). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), reflecting very low probability of exploitation in the near term (Feedly).

1. Prepare malicious input: Craft or obtain a malformed PCAP file designed to produce an out-of-bounds index when parsed by getradiotapfield(). The reporter provided 17 such files (mal_inputs.zip) that reliably trigger the crash.
2. Gain local access: The attack vector is local — the attacker must be able to execute hcxpcapngtool on the target system, either directly or by placing a crafted file where an automated process will feed it to the tool.
3. Execute the tool with the crafted input: Run ./hcxpcapngtool mal_input.pcap. The malformed radiotap field data causes getradiotapfield() to access memory 0 bytes past the end of the usedfrequency global array.
4. Trigger crash (DoS): The program aborts with an AddressSanitizer global-buffer-overflow error (or a segmentation fault without ASan), resulting in a denial of service (GitHub Issue).

• File System: Presence of unexpected or externally supplied .pcap files in directories used by hcxpcapngtool; crafted PCAP files with malformed radiotap headers.
• Logs: Application crash logs or core dumps from hcxpcapngtool; AddressSanitizer output referencing global-buffer-overflow in hcxpcapngtool.c:4891.
• Process: Abnormal termination (exit code indicating signal/abort) of hcxpcapngtool processes, particularly when processing files from untrusted sources (GitHub Issue).

No official patch has been released as of the time of this report. Users should upgrade hcxtools to a patched version once one becomes available from the ZerBea/hcxtools repository. In the interim, restrict local access to systems running hcxtools v7.0.1 to trusted users only, and avoid processing PCAP files from untrusted or unknown sources. Monitor for unexpected application crashes related to hcxpcapngtool (Feedly, GitHub Issue).

The vulnerability was noted in automated CVE tracking feeds including Bluesky CVE bots and aggregators such as VulDB, cvefeed.io, and ENISA's EUVD (EUVD-2026-16212). No significant vendor statements, named researcher commentary, or major media coverage has been identified beyond the original GitHub issue report (Feedly).