CVE-2026-15164: Wireshark ciscodump Denial of Service Vulnerability

Technical summary

CVE-2026-15164 is a buffer over-read vulnerability (CWE-122) in the ciscodump capture module of Wireshark. The vulnerability permits a local denial of service attack when a user opens or processes a specially crafted input. The attack vector is local, requires no privileges, but does require user interaction such as opening a malicious file or network capture. The impact is restricted to availability; no confidentiality or integrity breach occurs. The CVSS 3.1 score of 5.5 (MEDIUM) reflects the local-only attack surface and user interaction requirement, despite the availability impact being rated as high.

Business impact

Denial of service to Wireshark users conducting packet analysis or network diagnostics. The impact is primarily operational—interruption of security monitoring, incident response workflows, or network troubleshooting activities. Since Wireshark is often a support tool rather than a production service, the real-world impact depends on how critical live packet capture is to your organization's security operations. Organizations heavily reliant on Wireshark for threat hunting or SOC activities will experience workflow disruption.

Affected systems

Wireshark ciscodump versions 4.6.0–4.6.6 and 4.4.0–4.4.16 are vulnerable. Users running Wireshark versions outside these ranges, or those not using the ciscodump capture interface, are unaffected. Check your installed Wireshark version via Help > About Wireshark to confirm exposure.

Exploitability

Exploitation requires local access and user interaction—a user must open or process a malicious capture file or input. This is not remotely exploitable and does not grant elevated privileges or system compromise. The practical exploit barrier is moderate; an attacker must socially engineer a user into opening a crafted file. No authenticated access or special configuration is required on the target system. This vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active in-the-wild exploitation has not been documented at the time of publication.

Remediation

Update Wireshark to a patched version. For affected users, upgrade to the next available release beyond 4.6.6 or 4.4.16 in their respective branches. Consult the Wireshark project release notes and security advisories to confirm the exact patched versions. In the interim, restrict opening untrusted capture files or limit ciscodump usage to trusted sources only.

Patch guidance

Verify the latest stable Wireshark release from wireshark.org/download. Users on the 4.6.x branch should upgrade to the first release after 4.6.6; users on the 4.4.x branch should upgrade to the first release after 4.4.16. Long-term support (LTS) users on older branches should check whether their version line is still maintained and whether a patch has been backported. Test the upgrade in a non-production security environment first if Wireshark is integral to your incident response workflow.

Detection guidance

Monitor for unexpected Wireshark process crashes or restarts, particularly following the opening of capture files from external or untrusted sources. In Windows environments, look for Event Viewer entries showing ciscodump or wireshark crashes. On Linux/macOS, check system logs (dmesg, syslog) for segmentation faults or core dumps involving wireshark. If possible, implement file integrity monitoring on capture file directories to detect introduction of suspicious files. Endpoint Detection and Response (EDR) tools may flag repeated crash patterns as anomalous behavior.

Why prioritize this

Assign this a medium priority due to the local-only attack surface and user interaction requirement, combined with the operational (not critical-system) nature of Wireshark. Organizations should patch during a normal maintenance window rather than treating this as an emergency. Prioritize patching if Wireshark is a key component of your SOC or threat-hunting workflow, or if your users frequently handle captures from untrusted or external networks.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects: local-only attack vector (AV:L), low complexity (AC:L), no privilege requirement (PR:N), but user interaction necessary (UI:R). The impact is limited to availability (A:H), with no confidentiality or integrity impact. The moderate score appropriately captures a nuisance-level threat that disrupts workflows but does not lead to system compromise or data theft.

Frequently asked questions