By vendor

Wireshark vulnerabilities

Known CVEs affecting Wireshark products, prioritized by severity, with SEC.co remediation and detection guidance.

12 published vulnerabilities

• CVE-2026-15167HIGH 7.5

  Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16 contain a vulnerability in how they parse DBS Etherwatch files that can cause the application to crash. An attacker can exploit this by sending a specially crafted file that triggers a stack-based buffer overflow, resulting in a denial of service. The attack requires no user privileges or interaction beyond opening a malicious file, making it a straightforward vector for disruption in environments where Wireshark is used for network analysis.

• CVE-2026-15163MEDIUM 5.5

  Wireshark, a widely-used network traffic analysis tool, contains multiple bugs in its protocol dissectors—the components that interpret different network protocols—that can cause the application to loop infinitely when processing specially crafted packets. An attacker or malicious file can trigger these infinite loops, freezing Wireshark and making it unresponsive until the process is forcibly terminated. This affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. The vulnerability requires user interaction (opening a malicious capture file or analyzing a malicious packet stream) but does not allow data theft or system compromise—only denial of service.

• CVE-2026-15164MEDIUM 5.5

  A crash vulnerability exists in Wireshark's ciscodump utility affecting versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. The flaw can be triggered locally by an unprivileged user through user interaction, causing the application to crash and denying service to legitimate users. This is a moderate-severity issue with no code execution or data exposure risk.

• CVE-2026-15165MEDIUM 5.5

  Wireshark versions 4.6.0 through 4.6.6 contain a flaw in how they process TLS Encrypted Client Hello (ECH) data that can cause the application to crash when a user opens a maliciously crafted network capture file. This is a denial-of-service issue—an attacker cannot steal data or gain control of your system, but they can disrupt your ability to analyze network traffic. The vulnerability requires user interaction (opening a file) and only affects your local machine.

• CVE-2026-15166MEDIUM 5.5

  Wireshark, a widely-used network traffic analysis tool, contains a flaw in its IEEE 802.11 wireless protocol parser that can cause the application to crash when processing specially crafted network packets. The vulnerability affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. An attacker who can trick a user into opening a malicious packet capture file or viewing live traffic on a compromised network could trigger a denial of service, forcing the analyst to restart their investigation. While the impact is localized to availability rather than exposing sensitive data, this disruption can interfere with incident response workflows and network troubleshooting.

• CVE-2026-15169MEDIUM 5.5

  A vulnerability in Wireshark's UMTS FP protocol dissector can cause the application to crash when processing malformed network packets. This affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. An attacker could exploit this by crafting a specially designed UMTS packet that, when analyzed by Wireshark, triggers a denial of service condition, rendering the packet analysis tool temporarily unavailable.

• CVE-2026-15170MEDIUM 5.5

  Wireshark, the widely-used network analysis tool, contains a flaw in how it processes Z39.50 protocol traffic that can cause the application to crash. An attacker or malicious network traffic could trigger this crash, disrupting network troubleshooting and monitoring operations. This affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. The vulnerability requires local access and user interaction to exploit, limiting its attack surface.

• CVE-2026-15171MEDIUM 5.5

  Wireshark, the widely-used network packet analyzer, contains a flaw in its SSH protocol dissector that causes the application to crash when processing certain malformed SSH traffic. An attacker or adversary could exploit this by crafting specially malicious SSH packets that, when analyzed by a vulnerable Wireshark instance, would trigger a denial-of-service condition. The issue affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. While the vulnerability requires local user interaction (opening a file or live capture), it does not lead to data theft or system compromise—only application failure.

• CVE-2026-15172MEDIUM 5.5

  Wireshark, a widely-used network traffic analysis tool, contains a flaw in how it processes FMP/NOTIFY protocol packets. When a user opens a specially crafted network capture file or views malicious traffic, the dissector (the component that parses the protocol) crashes, causing Wireshark to stop responding. This is a local denial-of-service issue affecting versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. An attacker would need to deliver a malicious capture file or convince a user to analyze untrusted network traffic, but no special privileges are required on the target system.

• CVE-2026-15174MEDIUM 5.5

  Wireshark, a widely-used network packet analyzer, contains a flaw in its Catapult DCT2000 protocol dissector that can crash the application when processing malformed network packets. An attacker or malicious network traffic could trigger this crash, effectively denying service to anyone relying on Wireshark for network analysis. The vulnerability affects versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. Users outside these ranges are unaffected.

• CVE-2026-15173MEDIUM 4.7

  Wireshark versions 4.6.0 through 4.6.6 contain a flaw in how they parse pcapng packet capture files. A malformed pcapng file can cause Wireshark to crash, denying service to users who open the file. An attacker would need to trick a user into opening a specially crafted pcapng file, but requires no special privileges and the attack leaves no data integrity or confidentiality impact—only availability is affected.

• CVE-2026-15168LOW 2.5

  Wireshark's BLF (Binary Logging Format) file parser in recent versions contains a flaw that could leak sensitive information when a user opens a specially crafted BLF file. An attacker would need to trick a user into opening a malicious file locally—this is not a remote attack and requires user interaction. The risk is limited to potential disclosure of small amounts of data; the vulnerability does not enable system compromise, privilege escalation, or denial of service.