Wireshark is one of the world’s most widely used network protocol analyzers, trusted by SOC teams, network engineers, incident responders, penetration testers and security researchers.
But the same capability that makes Wireshark powerful also creates an important security consideration: Wireshark parses extremely complex and potentially untrusted network data.
A malicious packet capture, crafted network traffic, malformed protocol message or specially constructed profile can therefore trigger vulnerabilities in Wireshark’s protocol dissectors and file parsers.
In 2026, Wireshark has disclosed a significant number of security issues affecting protocol dissectors, file parsers, codecs, the dissection engine and the sharkd utility. The official Wireshark security advisory list includes vulnerabilities fixed throughout releases 4.6.x and 4.4.x. (Wireshark)
Security recommendation: Organizations using Wireshark for SOC investigations, malware analysis, PCAP inspection or incident response should keep it updated and avoid opening untrusted capture files with vulnerable versions.
Why Are Wireshark Vulnerabilities Important?
Wireshark is not normally an internet-facing server. Instead, it processes data.
That distinction is important.
An attacker does not necessarily need direct access to a Wireshark installation. If a security analyst opens a malicious .pcap, .pcapng, trace file or another supported input, vulnerable parsing code may process attacker-controlled data.
Potential consequences include:
- Application crashes
- Denial of service
- Infinite loops
- Memory exhaustion
- Memory leaks
- Heap or stack corruption
- Malformed packet processing
- Potential arbitrary code execution in specific vulnerabilities
The Wireshark project itself advises users running vulnerable versions to upgrade. (Wireshark)
2026 Wireshark CVE Overview
The following CVEs are among the vulnerabilities associated with the 2026 Wireshark security advisories and releases.
Severity shown below follows available CVSS information from NVD/CVE records. Where NVD and the CNA differ, the difference is explicitly noted rather than treating one score as universally authoritative.
|
CVE |
Component / Issue |
Severity |
|
CVE-2026-3201 |
USB HID memory exhaustion |
Medium |
|
CVE-2026-3203 |
RF4CE Profile dissector crash |
Medium |
|
CVE-2026-5299 |
ICMPv6 dissector crash |
Medium |
|
CVE-2026-5401 |
AFP dissector crash |
Medium |
|
CVE-2026-5402 |
TLS dissector crash / possible code execution |
High |
|
CVE-2026-5403 |
SBC codec crash / possible code execution |
High |
|
CVE-2026-5404 |
K12 RF5 parser crash |
Medium |
|
CVE-2026-5405 |
RDP dissector crash / possible code execution |
High |
|
CVE-2026-5406 |
FC-SWILS dissector crash |
Medium |
|
CVE-2026-5407 |
SMB2 infinite loop |
Medium |
|
CVE-2026-5408 |
BT-DHT dissector crash |
Medium |
|
CVE-2026-5409 |
Monero dissector crash |
Medium |
|
CVE-2026-5653 |
DCP-ETSI dissector crash |
Medium |
|
CVE-2026-5654 |
AMR-NB codec crash |
Medium |
|
CVE-2026-5655 |
SDP dissector crash |
Medium |
|
CVE-2026-5656 |
Profile-import path traversal / possible code execution |
High |
|
CVE-2026-5657 |
iLBC codec crash |
Medium |
|
CVE-2026-6519 |
MBIM infinite loop |
Medium |
|
CVE-2026-6520 |
OpenFlow v6 infinite loop |
Medium |
|
CVE-2026-6521 |
OpenFlow v5 infinite loop |
Medium |
|
CVE-2026-6522 |
RPKI-Router infinite loop |
Medium |
|
CVE-2026-6523 |
GNW infinite loop |
Medium |
|
CVE-2026-6524 |
MySQL dissector crash |
Medium |
|
CVE-2026-6527 |
ASN.1 PER dissector crash |
Medium |
|
CVE-2026-6530 |
DCP-ETSI dissector crash |
Medium |
|
CVE-2026-6531 |
SANE dissector infinite loop |
Medium |
|
CVE-2026-6532 |
Kismet dissector crash |
Medium |
|
CVE-2026-6533 |
LZ77 decompression crash |
Medium |
|
CVE-2026-6534 |
USB HID infinite loop |
Medium |
|
CVE-2026-6535 |
zlib decompression crash |
Medium |
|
CVE-2026-6536 |
DLMS/COSEM infinite loop |
Medium |
|
CVE-2026-6537 |
ZigBee dissector crash |
Medium |
|
CVE-2026-6538 |
BEEP dissector crash |
Medium |
|
CVE-2026-6868 |
HTTP dissector stack buffer overflow |
Medium |
|
CVE-2026-6869 |
WebSocket dissector crash |
Medium |
|
CVE-2026-6870 |
GSM RP dissector crash |
Medium |
|
CVE-2026-7379 |
sharkd memory leak |
High by NVD; Medium by CNA |
|
CVE-2026-95386 |
TTL parser infinite loop |
Medium |
|
CVE-2026-95387 |
SPDY dissector crash |
Medium |
|
CVE-2026-95388 |
sharkd crash |
Medium |
|
CVE-2026-95389 |
SCTP dissector crash |
Medium |
|
CVE-2026-95390 |
PEAK CAN TRC parser crash |
Medium |
|
CVE-2026-95391 |
ZigBee ZCL dissector crash |
Medium |
|
CVE-2026-95392 |
MBIM dissector crash |
Medium |
|
CVE-2026-95393 |
CSN.1 dissector crash |
Medium |
|
CVE-2026-95394 |
Microsoft Network Monitor parser large loop |
Medium |
|
CVE-2026-95395 |
IEEE C37.118 memory leak |
Medium |
|
CVE-2026-96415 |
Catapult DCT2000 dissector crash |
Medium |
|
CVE-2026-96416 |
IEEE 802.11 dissector crash |
Medium |
|
CVE-2026-96417 |
RF4CE dissector crash |
Medium |
|
CVE-2026-96418 |
TIFF parser infinite loop |
Medium |
|
CVE-2026-96419 |
Profile import crash / possible code execution |
High |
|
CVE-2026-96420 |
Toshiba parser crash |
Medium |
|
CVE-2026-96421 |
USB HID infinite loop / memory leak |
Medium |
|
CVE-2026-96422 |
Frame protocol metadissector crash |
Medium |
|
CVE-2026-96423 |
X11 dissector crash |
Medium |
Important: CVSS classifications can differ between NVD and the CVE Numbering Authority. For example, NVD currently rates CVE-2026-7379 at 7.5 High, while its CNA score is 5.5 Medium. (NVD)
Critical Vulnerabilities: Is Wireshark Actually “Critical”?
One important point is frequently misunderstood.
A vulnerability does not become automatically Critical simply because it exists in a security tool.
For example, CVE-2026-5406 is a Wireshark FC-SWILS dissector crash. The CNA assigns it CVSS 3.1 5.5 Medium, with the attack requiring local access and user interaction. (NVD)
Similarly, CVE-2026-5408, involving the BT-DHT dissector, is assigned 5.5 Medium by its CNA. (NVD)
However, some Wireshark vulnerabilities deserve much greater attention because their descriptions include possible code execution.
CVE-2026-5656 — Profile Import Path Traversal
One of the more security-sensitive 2026 issues is CVE-2026-5656.
The vulnerability involves path traversal during Wireshark profile import.
According to the CVE record, affected versions are:
- Wireshark 4.6.0 through 4.6.4
- Wireshark 4.4.0 through 4.4.14
The CVE record assigns:
CVSS 3.1: 7.0 — HIGH
The issue can result in denial of service and possible code execution. (CVE)
This is particularly relevant to organizations that exchange Wireshark profiles or use shared analysis environments.
CVE-2026-6868 — HTTP Dissector Stack Buffer Overflow
CVE-2026-6868 affects Wireshark’s HTTP protocol dissector.
The vulnerability is described as a stack-based buffer overflow that can cause a denial of service.
The CVE record assigns:
CVSS 3.1: 5.5 — MEDIUM
Affected versions include Wireshark 4.6.0–4.6.4 and 4.4.0–4.4.14. (CVE)
Although the score is Medium, buffer-overflow vulnerabilities deserve careful attention because memory-safety weaknesses can sometimes have consequences beyond the currently documented impact.
CVE-2026-7379 — sharkd Memory Leak
sharkd is Wireshark’s analysis utility.
CVE-2026-7379 concerns a memory leak in sharkd that can lead to denial of service.
The interesting aspect of this CVE is the difference between scoring authorities:
- NVD: 7.5 — HIGH
- CNA: 5.5 — MEDIUM
NVD’s vector describes a network-based attack with no privileges or user interaction, while the CNA vector describes a local attack requiring user interaction. (NVD)
This is a good example of why vulnerability management teams should not blindly copy a severity value without examining the underlying CVSS vector.
Latest Wave: Wireshark 4.6.9
Wireshark 4.6.9 was released on September 23, 2026.
The release fixes a large group of vulnerabilities, including:
- ZigBee ZCL dissector crash
- SCTP dissector crash
- TTL parser infinite loop
- PEAK CAN TRC parser crash
- IEEE C37.118 memory leak
- SPDY dissector crash
- Microsoft Network Monitor parser large loop
- CSN.1 dissector crash
- MBIM dissector crash
- sharkd crash
- Frame protocol metadissector crash
- USB HID infinite loop and memory leak
- RF4CE dissector crash
- Toshiba parser crash
- Profile import crash and possible code execution
- TIFF parser infinite loop
- X11 dissector crash
- IEEE 802.11 dissector crash
- Catapult DCT2000 dissector crash
The official 4.6.9 release notes identify CVE numbers for these issues, including CVE-2026-95386 through CVE-2026-95395 and CVE-2026-96415 through CVE-2026-96423. (Wireshark)
Why Wireshark Has So Many Dissector Vulnerabilities
Wireshark supports a huge number of protocols and file formats.
Every dissector is effectively a parser.
For example:
Packet → Protocol identification → Dissector → Field parsing → Memory allocation → Display
A malformed input can therefore reach deeply nested parsing logic.
Common vulnerability classes include:
1. Buffer overflows
Incorrect length calculations can cause memory to be accessed outside its intended boundary.
2. Infinite loops
A malformed packet can cause a parser to repeatedly process the same data.
3. Memory leaks
Repeated processing can consume memory until the application becomes unstable or unavailable.
4. Resource exhaustion
Attackers can provide input that requires excessive CPU or memory resources.
5. Path traversal
Imported profiles or configuration files can potentially manipulate filesystem paths.
6. Code execution
Some memory corruption or path-handling vulnerabilities can potentially progress beyond application crashes to arbitrary code execution.
2026 Wireshark Vulnerability Timeline
January 2026
Wireshark 4.6.3 and 4.4.13 addressed multiple security issues.
February 2026
Wireshark 4.6.4 and 4.4.14 continued vulnerability remediation, including USB HID memory exhaustion and RF4CE issues. (Wireshark)
April 2026
Wireshark 4.6.5 and 4.4.15 addressed a large collection of vulnerabilities involving protocol dissectors, codecs, parsers and the dissection engine. (Wireshark)
May 2026
Wireshark 4.6.6 and 4.4.16 were released with additional security fixes.
July 2026
Wireshark 4.6.7 and 4.4.17 addressed further vulnerabilities, including SSH and other protocol dissector issues.
August 2026
Wireshark 4.6.8 and 4.4.18 fixed additional security vulnerabilities. (Wireshark)
September 2026
Wireshark 4.6.9 and 4.4.19 were released, fixing another substantial set of vulnerabilities. (Wireshark)
Which Wireshark Versions Are Affected?
The exact affected version depends on the individual CVE.
However, many 2026 vulnerabilities affect branches around:
Wireshark 4.6.0 → 4.6.4
and/or
Wireshark 4.4.0 → 4.4.14
with fixes introduced in later releases.
For example, CVE-2026-5656 affects versions before 4.6.5 and before 4.4.15. (CVE)
Therefore, security teams should evaluate the exact CVE against their installed version rather than assuming that every 4.x installation is affected.
Security Impact for SOC Teams
For a SOC analyst, Wireshark may be used to investigate:
- Malware traffic
- Phishing incidents
- C2 communications
- DNS attacks
- Ransomware investigations
- Suspicious network sessions
- Data exfiltration
- PCAP files received from third parties
- Incident-response evidence
This creates an important attack surface.
A malicious actor could potentially provide a crafted capture file to an analyst and rely on the analyst opening it during an investigation.
That means security tools themselves must be included in vulnerability-management programs.
Recommended Mitigation
1. Upgrade Wireshark
The primary mitigation is to install a supported release containing the relevant security fixes.
The current official Wireshark security page should be used to verify the latest security advisories and fixed versions. (Wireshark)
2. Do Not Open Untrusted PCAP Files on Critical Analyst Workstations
Treat unknown .pcap and .pcapng files as potentially hostile input.
3. Use an Isolated Analysis Environment
For suspicious captures, consider:
- Dedicated analysis VM
- Restricted network access
- Non-production workstation
- Least-privilege account
- Endpoint monitoring
- Disposable analysis environment
4. Patch
sharkd
Organizations using Wireshark programmatically or through automation should separately inventory sharkd because several 2026 vulnerabilities involve the utility.
5. Monitor CVE Feeds
Security teams should continuously monitor:
- Wireshark Security Advisories
- CVE
- NVD
- Vendor release notes
CVE Severity Is Not the Same as Business Risk
A Medium CVSS vulnerability can still deserve urgent remediation in a SOC environment if:
- Analysts regularly open untrusted PCAPs
- Wireshark is installed on privileged machines
- The system processes captures automatically
- The vulnerable component is exposed through automation
- The vulnerability is used in an attack chain
Conversely, a High CVSS vulnerability may have limited practical exposure if the vulnerable functionality is never used.
Therefore:
CVSS + Exposure + Asset Criticality + Exploitability + Business Context = Practical Risk
SOCShield Vulnerability Management Checklist
Security teams should answer these questions:
- ☐ Which Wireshark versions are installed?
- ☐ Are 4.4.x or 4.6.x versions still present?
- ☐ Are analysts opening third-party PCAP files?
- ☐ Is Wireshark installed on privileged systems?
- ☐ Is sharkd being used?
- ☐ Are Wireshark profiles exchanged between users?
- ☐ Are suspicious captures analyzed inside isolated VMs?
- ☐ Are Wireshark security advisories monitored?
- ☐ Are endpoint controls enabled on analyst systems?
- ☐ Are old vulnerable versions removed after upgrades?
Final Takeaway
Wireshark remains an essential tool for network visibility and incident response, but its extensive protocol-parsing capabilities also create a substantial software attack surface.
The 2026 vulnerability disclosures demonstrate that vulnerabilities can occur across virtually every layer of packet analysis—from individual protocol dissectors to file parsers, codecs, decompression engines and analysis utilities.
The most important lesson for security teams is simple:
A cybersecurity tool is still software—and cybersecurity software must be patched.
Organizations should maintain an accurate inventory of Wireshark installations, monitor the official security advisories, upgrade affected versions promptly, and treat untrusted PCAP files as potentially hostile input.
For SOC analysts, vulnerability management teams and security engineers, keeping Wireshark updated is not merely a software-maintenance task—it is part of protecting the security tools used to investigate the rest of the environment.
Official References
Last reviewed: September 28, 2026
Comments
Post a Comment