Description

Crash in the Wireshark dissection engine in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-19T23:16:19.677Z",
  "pubdate": "2026-08-19T23:16:19.677Z",
  "executiveSummary": "A denial of service vulnerability exists within the dissection engine of Wireshark, affecting versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. The vulnerability allows an unauthenticated remote attacker to trigger a crash within the application via the processing of malicious or malformed packets.\nThe flaw specifically impacts the core packet dissection subsystem, leading to abnormal application termination and rendering the analysis tool unavailable. This poses a significant operational risk in environments where network analysis and real-time traffic monitoring are critical for security operations and incident response.\nExploitation requires the victim to process a specially crafted network capture file or capture live traffic containing the malicious payload. The attacker capabilities are limited to causing a denial of service through application crashes, with no direct mechanism for remote code execution or privilege escalation indicated based on the crash condition.\nMitigation requires upgrading Wireshark to patched versions beyond the affected ranges or restricting the analysis of untrusted network traffic to isolated environments.",
  "technicalDetails": "The vulnerability resides within the packet dissection engine of Wireshark, specifically affecting versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.18. The root cause stems from improper input validation or memory handling during the parsing and processing of specific protocol structures within network traffic payloads or capture files.\nWhen Wireshark reads a malformed packet stream, the vulnerable dissection routine fails to adequately verify boundary conditions, field lengths, or protocol syntax constraints. This results in undefined behavior, such as a NULL pointer dereference, buffer over-read, or assertion failure, which triggers an immediate application crash.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious packet payload containing specifically manipulated protocol fields designed to trigger the edge case in the targeted dissector. Second, this payload is transmitted across a network monitored by a vulnerable instance of Wireshark or packaged into a malicious capture file (pcap). Third, when the victim opens the capture file or captures live traffic containing the malicious sequence, the Wireshark dissection engine attempts to parse the malformed data. Fourth, the parsing logic encounters the invalid state, causing an unhandled exception or fatal error that terminates the Wireshark process.\nThe vulnerable component is the protocol dissection subsystem. Authentication and privilege requirements are absent, as the crash is triggered purely by the data processed by the application. The attack vector can be local via malicious file ingestion or remote if the application is exposed to untrusted live network streams. The payload behavior is strictly destructive to process availability, resulting in a denial of service without yielding post-exploitation persistence or remote code execution vectors."
}