SB2026043061 - Multiple vulnerabilities in Wireshark

Security Bulletin ID SB2026043061

CSH Severity

High

Patch available

YES

Number of vulnerabilities 43

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 43 vulnerabilities.

1) Uncontrolled Recursion (CVE-ID: CVE-2026-5409)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite recursion in the Monero protocol dissector. A remote attacker can trick a victim to open a specially crafted packet trace file and perform a denial of service (DoS) attack.

2) Heap-based buffer overflow (CVE-ID: CVE-2026-6529)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the iLBC audio codec. A remote attacker can trick a victim to open a specially crafted packet trace file, trigger a heap-based buffer overflow and cause a denial of service condition on the target system.

3) Heap-based buffer overflow (CVE-ID: CVE-2026-6530)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the DCP-ETSI protocol dissector. A remote attacker can trick a victim to open a specially crafted packet trace file, trigger a heap-based buffer overflow and cause a denial of service condition on the target system.

4) Infinite loop (CVE-ID: CVE-2026-6531)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in the SANE protocol dissector. A remote attacker can consume all available system resources and cause denial of service conditions.

5) Out-of-bounds read (CVE-ID: CVE-2026-6532)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in the Kismet protocol dissector. A remote attacker can trick a victim to open a specially crafted packet trace file, trigger an out-of-bounds read error and cause a denial of service condition on the system.

6) Improperly Controlled Sequential Memory Allocation (CVE-ID: CVE-2026-6533)

CWE-ID: CWE-1325 - Improperly Controlled Sequential Memory Allocation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improperly controlled sequential memory allocation within Dissection engine zlib decompression. A remote attacker can trick a victim to open a specially crafted packet trace file and perform a denial of service (DoS) attack.

7) Infinite loop (CVE-ID: CVE-2026-6534)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in the USB HID protocol dissector. A remote attacker can perform a denial of service (DoS) attack.

8) Improperly Controlled Sequential Memory Allocation (CVE-ID: CVE-2026-6535)

CWE-ID: CWE-1325 - Improperly Controlled Sequential Memory Allocation

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improperly controlled sequential memory allocation within Dissection engine zlib decompression. A remote attacker can perform a denial of service (DoS) attack.

9) Infinite loop (CVE-ID: CVE-2026-6536)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in the DLMS/COSEM protocol dissector. A remote attacker can consume all available system resources and cause denial of service conditions.

10) Stack-based buffer overflow (CVE-ID: CVE-2026-6537)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the ZigBee protocol dissector. A remote attacker can trick a victim to open a specially crafted packet trace file, trigger stack-based buffer overflow and cause a denial of service condition on the target system.

11) Stack-based buffer overflow (CVE-ID: CVE-2026-6538)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the BEEP protocol dissector. A remote attacker can trick a victim to open a specially crafted packet trace file, trigger stack-based buffer overflow and cause a denial of service condition on the target system.

12) Heap-based buffer overflow (CVE-ID: CVE-2026-5653)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the DCP-ETSI protocol dissector. A remote attacker can trick a victim to open a specially crafted packet trace file, trigger a heap-based buffer overflow and cause a denial of service condition on the target system.

13) Path traversal (CVE-ID: CVE-2026-5656)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in the Configuration Profile import feature. A remote attacker can trick a victim to import a malformed configuration profile and write arbitrary files on the system, leading to arbitrary code execution.

14) Double free (CVE-ID: CVE-2026-5657)

CWE-ID: CWE-415 - Double Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the iLBC codec. A remote attacker can trick a victim to open a specially crafted packet trace file, trigger double free error and cause a denial of service condition on the target system.

15) Use-after-free (CVE-ID: CVE-2026-5655)

CWE-ID: CWE-416 - Use After Free

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in the SDP protocol dissector. A remote attacker can trick a victim to open a specially crafted packet trace file and perform a denial of service (DoS) attack.

16) Stack-based buffer overflow (CVE-ID: CVE-2026-5654)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the AMR-NB codec. A remote attacker can trick a victim to open a specially crafted packet trace file, trigger stack-based buffer overflow and cause a denial of service condition on the target system.

17) Heap-based buffer overflow (CVE-ID: CVE-2026-5405)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the RDP dissector. A remote attacker can trick a victim to open a specially crafted packet trace file, trigger a heap-based buffer overflow and cause a denial of service condition on the target system.

18) Heap-based buffer overflow (CVE-ID: CVE-2026-5403)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the SBC audio codec. A remote attacker can trick a victim to open a specially crafted packet trace file, trigger a heap-based buffer overflow and cause a denial of service condition on the target system.

19) Stack-based buffer overflow (CVE-ID: CVE-2026-5404)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the K12 RF5 file parser. A remote attacker can trick a victim to open a specially crafted packet trace file, trigger stack-based buffer overflow and cause a denial of service condition on the target system.

20) Heap-based buffer overflow (CVE-ID: CVE-2026-5402)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the TLS protocol dissector. A remote attacker can trick a victim to open a specially crafted packet trace file, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

21) Uncontrolled Recursion (CVE-ID: CVE-2026-5401)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite recursion in the AFP Spotlight protocol dissector. A remote attacker can trick a victim to open a specially crafted packet trace file and perform a denial of service (DoS) attack.

22) Uncontrolled Recursion (CVE-ID: CVE-2026-5299)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite recursion in the ICMPv6 PvD protocol dissector. A remote attacker can trick a victim to open a specially crafted packet trace file and perform a denial of service (DoS) attack.

23) Infinite loop (CVE-ID: CVE-2026-5407)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop in the SMB2 protocol dissector. A remote attacker can trick a victim to open a specially crafted packet trace file and cause denial of service conditions.

24) Uncontrolled Recursion (CVE-ID: CVE-2026-5406)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite recursion in the FC-SWILS protocol dissector. A remote attacker can trick a victim to open a specially crafted packet trace file and perform a denial of service (DoS) attack.

25) Uncontrolled Recursion (CVE-ID: CVE-2026-5408)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite recursion in the BT-DHT protocol dissector. A remote attacker can trick a victim to open a specially crafted packet trace file and perform a denial of service (DoS) attack.

26) Input validation error (CVE-ID: CVE-2026-6521)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the OpenFlow v5 protocol dissector when parsing malformed packets or packet trace files. A remote attacker can inject a malformed packet onto the wire or trick the victim into opening a malformed packet trace file to cause a denial of service.

User interaction is required when exploitation is performed via a crafted packet trace file.

27) Input validation error (CVE-ID: CVE-2026-6520)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the OpenFlow v6 protocol dissector when parsing a malformed packet or packet trace file. A remote attacker can inject a malformed packet onto the wire or convince a victim to open a malformed packet trace file to cause a denial of service.

User interaction is required when exploitation uses a crafted packet trace file.

28) Input validation error (CVE-ID: CVE-2026-6519)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in MBIM protocol dissector when parsing malformed packets or packet trace files. A remote attacker can inject a malformed packet onto the wire or convince a victim to open a malformed packet trace file to cause a denial of service.

User interaction is required when exploitation uses a crafted packet trace file.

29) Infinite loop (CVE-ID: CVE-2026-6522)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in the RPKI-Router protocol dissector when parsing malformed packet data. A remote attacker can inject a malformed packet onto the wire or trick the victim into opening a malformed packet trace file to cause a denial of service.

User interaction is required when exploitation uses a malformed packet trace file.

30) Input validation error (CVE-ID: CVE-2026-6870)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the GSM RP protocol dissector when parsing malformed packets or packet trace files. A remote attacker can inject a malformed packet onto the wire or convince a victim to open a malformed packet trace file to cause a denial of service.

User interaction is required when exploitation is performed via a crafted packet trace file.

31) Input validation error (CVE-ID: CVE-2026-6869)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the WebSocket protocol dissector when parsing malformed packets or packet trace files. A remote attacker can inject a malformed packet onto the wire or trick the victim into opening a malformed packet trace file to cause a denial of service.

User interaction is required to open a crafted packet trace file.

32) Input validation error (CVE-ID: CVE-2026-6867)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the SMB2 protocol dissector when parsing malformed SMB2 packets or malformed packet trace files. A remote attacker can inject a malformed packet onto the wire or trick the victim into opening a malformed packet trace file to cause a denial of service.

User interaction is required when exploitation is performed via a malformed packet trace file.

33) Input validation error (CVE-ID: CVE-2026-6868)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the HTTP protocol dissector when parsing malformed packets or packet trace files. A remote attacker can inject a malformed packet onto the wire or convince a victim to open a malformed packet trace file to cause a denial of service.

User interaction is required when exploitation uses a malformed packet trace file.

34) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in sharkd utility when handling requests. A remote attacker can send crafted requests to cause a denial of service.

The issue could leak memory and may also cause excessive CPU consumption.

35) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in sharkd utility when handling requests. A remote attacker can send a crafted request to cause a denial of service.

36) Input validation error (CVE-ID: CVE-2026-6527)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in ASN.1 PER dissectors when parsing malformed packets or packet trace files. A remote attacker can inject a malformed packet onto the wire or convince a victim to open a malformed packet trace file to cause a denial of service.

User interaction is required when exploitation is performed via a crafted packet trace file.

37) Input validation error (CVE-ID: CVE-2026-6524)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the MySQL protocol dissector when parsing malformed packets or packet trace files. A remote attacker can inject a malformed packet onto the wire or trick the victim into opening a malformed packet trace file to cause a denial of service.

User interaction is required when exploitation is performed via a malformed packet trace file.

38) Infinite loop (CVE-ID: CVE-2026-6523)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in the GNW protocol dissector when processing a malformed packet or parsing a malformed packet trace file. A remote attacker can inject a malformed packet onto the wire or trick the victim into opening a malformed packet trace file to cause a denial of service.

User interaction is required to open a malformed packet trace file.

39) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in sharkd utility when handling requests. A remote attacker can send a crafted request to cause a denial of service.

40) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper loop control in the UDS protocol dissector when parsing malformed packets or packet trace files. A remote attacker can inject a malformed packet onto the wire or convince a victim to open a malformed packet trace file to cause a denial of service.

User interaction is required when exploitation is performed via a crafted packet trace file.

41) Input validation error (CVE-ID: CVE-2026-6528)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the TLS protocol dissector when parsing crafted TLS traffic. A remote attacker can supply malformed input to trigger an infinite loop to cause a denial of service.

42) Input validation error (CVE-ID: CVE-2026-6526)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the RTSP protocol dissector when parsing malformed RTSP packets or packet trace files. A remote attacker can inject a malformed packet onto the wire or convince a victim to open a malformed packet trace file to cause a denial of service.

User interaction is required when exploitation is performed via a malformed packet trace file.

43) Input validation error (CVE-ID: CVE-2026-6525)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in the IEEE 802.11 protocol dissector when parsing malformed packets or packet trace files. A remote attacker can inject a malformed packet onto the wire or convince a victim to open a malformed packet trace file to cause a denial of service.

User interaction is required when exploitation is performed via a crafted packet trace file.

Remediation

Install update from vendor's website.

SB2026043061 - Multiple vulnerabilities in Wireshark

Breakdown by Severity

Description

Remediation

References

Please verify you're human