Description

Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-08-19T23:16:20.243Z",
  "pubdate": "2026-08-19T23:16:20.243Z",
  "executiveSummary": "A denial of service vulnerability exists within the sharkd component of Wireshark versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. The flaw allows an attacker to trigger an application crash, resulting in service disruption for affected instances.\nThe vulnerability directly impacts availability, causing the sharkd daemon to terminate unexpectedly when processing specifically crafted inputs or malformed requests.\nThis issue poses a risk to environments relying on automated packet analysis pipelines or remote packet inspection interfaces driven by sharkd. Exploitation typically requires network access to the listening service or the ability to supply malicious payloads to the parsing engine.\nNo specific authentication or heightened privilege requirements are inherently mandated by the vulnerability mechanics if the service is exposed to untrusted networks.\nRemediation requires upgrading the affected software to patched versions once made available by the vendor, alongside strict network segmentation and access controls to limit exposure of the sharkd interface to trusted administrative zones.",
  "technicalDetails": "The vulnerability resides in the sharkd component of the Wireshark application, specifically within parsing or request-handling logic across versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18.\nThe root cause stems from improper input validation or memory handling when sharkd parses complex or maliciously constructed commands and packet data streams, leading to a fatal exception, assertion failure, or segmentation fault.\nThe vulnerable component is exposed via the sharkd daemon interface, which typically listens for JSON-RPC-like commands to facilitate remote packet analysis.\nThe attack flow proceeds as follows: An attacker sends a crafted payload or command sequence to the listening sharkd service. Upon receiving the input, the internal parsing routines attempt to process the malformed structure without adequate bounds checking or error handling. This triggers an invalid memory access or an unhandled exception condition within the underlying C codebase.\nConsequently, the operating system terminates the process to prevent further memory corruption, resulting in an immediate denial of service for any dependent processes or connected clients.\nExploitation requires network reachability to the sharkd service port. Depending on the deployment architecture, the service may be bound to localhost or exposed across a network interface, determining whether local or remote adversaries can initiate the attack sequence.\nNo post-exploitation impact beyond application termination and denial of service is documented, as the vulnerability manifests primarily as an availability violation rather than a remote code execution vector."
}