Heap-based buffer overflow in Wireshark - CVE-2026-5405

Vulnerability identifier: #VU128532

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-5405

CWE-ID: CWE-122

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error in the RDP dissector. A remote attacker can trick a victim to open a specially crafted packet trace file, trigger a heap-based buffer overflow and cause a denial of service condition on the target system.

Wireshark
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
openSUSE Leap
wireshark-ui-qt
libwsutil15-debuginfo
libwiretap14
wireshark-ui-qt-debuginfo
libwireshark17
libwiretap14-debuginfo
libwireshark17-debuginfo
wireshark-debugsource
wireshark-devel
wireshark-debuginfo
wireshark
libwsutil15
wireshark (Red Hat package)

Install updates from vendor's website.

Wireshark - addressed in versions 4.4.15, 4.6.5
wireshark-ui-qt - update to 4.2.14-150600.18.41.1
libwsutil15-debuginfo - update to 4.2.14-150600.18.41.1
libwiretap14 - update to 4.2.14-150600.18.41.1
wireshark-ui-qt-debuginfo - update to 4.2.14-150600.18.41.1
libwireshark17 - update to 4.2.14-150600.18.41.1
libwiretap14-debuginfo - update to 4.2.14-150600.18.41.1
libwireshark17-debuginfo - update to 4.2.14-150600.18.41.1
wireshark-debugsource - update to 4.2.14-150600.18.41.1
wireshark-devel - update to 4.2.14-150600.18.41.1
wireshark-debuginfo - update to 4.2.14-150600.18.41.1
wireshark - update to 4.2.14-150600.18.41.1
libwsutil15 - update to 4.2.14-150600.18.41.1
wireshark (Red Hat package) - update to 4.4.2-3.el10_0.4

• https://www.wireshark.org/security/wnpa-sec-2026-17.html

• Multiple vulnerabilities in Wireshark
• Red Hat Enterprise Linux 10 update for wireshark
• SUSE update for wireshark