CVE-2026-15165: Wireshark TLS ECH Denial of Service Vulnerability (4.6.0–4.6.6)

Technical summary

A buffer overflow vulnerability exists in Wireshark's TLS ECH decryptor (CWE-122: Heap-based Buffer Overflow). When processing ECH extension data in TLS handshakes within PCAP files, insufficient bounds checking allows an out-of-bounds write that triggers a crash. The issue affects the wire protocol analysis layer and is triggered during pcap parsing and dissection. This is not a network-facing remote code execution—the attack surface is limited to locally-sourced capture files opened by a user.

Business impact

For security operations centers (SOCs) and network analysts, this vulnerability can interrupt incident investigation workflows. An attacker could distribute a poisoned PCAP file (via email, file share, or supply chain) that crashes Wireshark when opened, preventing analysis of that capture and potentially delaying threat detection or incident response. In environments where analysts routinely open untrusted capture files from customers, partners, or external sources, this represents a small but concrete operational risk.

Affected systems

Only Wireshark versions 4.6.0, 4.6.1, 4.6.2, 4.6.3, 4.6.4, 4.6.5, and 4.6.6 are affected. Users running Wireshark 4.8.x, 4.10.x, and later versions, as well as any version prior to 4.6.0, are not vulnerable. Check your installed version via Help > About Wireshark to determine exposure.

Exploitability

Exploitability is low in absolute terms. An attacker must craft a valid TLS handshake with a malformed ECH extension, save it in a PCAP file, and convince a user to open it in the vulnerable version. There is no remote exploitation path, no authentication bypass, and no privilege escalation. This is a file-based attack requiring user action. Public exploit code or proof-of-concept details are not widely circulated, though the mechanics are straightforward for someone with protocol knowledge.

Remediation

Upgrade Wireshark to version 4.6.7 or later. The Wireshark Project has released patches that add proper bounds checking to the ECH dissector. Alternatively, if you cannot upgrade immediately, minimize the opening of untrusted PCAP files, especially those from external sources. Consider restricting file-open operations to trusted, internal capture sources only.

Patch guidance

Wireshark 4.6.7 and subsequent releases in the 4.6 series include the fix. Verify against the official Wireshark release notes and security advisories at wireshark.org. Organizations on extended support for 4.8.x or 4.10.x should not be affected, but verify your exact version. Automated patching via your software distribution mechanism is recommended; manual downloads are available from the Wireshark website.

Detection guidance

Monitor for unexpected Wireshark process crashes, particularly on analyst workstations. Log file analysis of recent PCAP files opened may reveal the offending file. If you suspect a poisoned file is in circulation, isolate and quarantine it. Network-based detection is not applicable since this is a local file-parsing issue. Consider scanning recent file transfers for suspicious PCAP files with unusual TLS handshake extensions if a crash has occurred.

Why prioritize this

This vulnerability merits prompt but not emergency patching. It is a medium-severity denial-of-service with a low attack surface and requires user interaction. However, because Wireshark is a critical tool for incident response and threat hunting, any disruption to its availability during an active investigation could have downstream consequences. Organizations handling external or untrusted PCAP files should prioritize the upgrade within 30 days; those working only with internal network taps can schedule the patch within their normal update cycle.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects a local attack vector, no authentication requirement, low complexity, and high impact on availability. The score correctly emphasizes that while the denial-of-service is real, the attack requires user interaction and does not compromise confidentiality or integrity. This is appropriate for a file-parsing vulnerability in a non-privileged analysis tool.

Frequently asked questions