CVE-2026-15166: Wireshark IEEE 802.11 Denial of Service Vulnerability

Technical summary

CVE-2026-15166 is a stack-based buffer overflow (CWE-121) in Wireshark's IEEE 802.11 protocol dissector. The vulnerability is triggered during the parsing of malformed wireless frames, allowing an attacker to cause a crash by sending or crafting a packet capture containing out-of-bounds data that overwrites stack memory. The issue is locally exploitable—an attacker cannot remotely trigger the crash directly, but must either provide a malicious .pcap/.pcapng file to a user or redirect traffic to an affected Wireshark instance analyzing live traffic on a network the attacker controls. The parser does not properly validate frame length fields before copying data to a fixed-size buffer.

Business impact

The denial-of-service impact is moderate but operationally disruptive. Security operations centers, incident responders, and network engineers who rely on Wireshark for packet analysis face workflow interruptions if they inadvertently process a malicious capture. In active incident response scenarios, a crash forces re-engagement with the evidence and delays investigation timelines. Organizations performing forensic analysis or threat hunting could lose unsaved work. The financial impact is primarily productivity loss rather than data compromise, though in high-stakes incident response this can be material.

Affected systems

Wireshark 4.6.x versions from 4.6.0 through 4.6.16 are vulnerable, as are Wireshark 4.4.x versions from 4.4.0 through 4.4.16. Users of Wireshark 4.2.x, 4.0.x, and earlier legacy branches are unaffected by this specific flaw. The vulnerability does not affect Wireshark 4.8.0 and later (assuming vendor patches are applied in newer releases). All platforms running affected versions—Windows, macOS, and Linux—are equally vulnerable.

Exploitability

Exploitability is low-to-moderate. The attack vector is local; an attacker cannot exploit this remotely without first delivering a malicious file or packet capture to a user. User interaction is required—a security analyst must open a capture file or Wireshark must be analyzing traffic when the attacker sends the crafted packet. This means the vulnerability is practical in targeted scenarios (e.g., sending a malicious .pcap to a known analyst via email or hosting one on a website) but not a vector for mass exploitation. No public exploits are known to be in widespread circulation, and the vulnerability is not flagged in CISA's Known Exploited Vulnerabilities catalog.

Remediation

Organizations should update Wireshark to the patched versions as soon as practical. Verify against the vendor advisory for exact patched release numbers. Interim mitigations include restricting user access to open untrusted packet captures, disabling live packet capture if not actively in use, and educating analysts not to open .pcap files from unknown or unverified sources. Consider deploying Wireshark in sandboxed or isolated environments when analyzing potentially hostile network evidence.

Patch guidance

Consult the Wireshark security advisory for the exact patched version numbers and release dates, as patch version specifics are not provided in this intelligence summary. Typically, vendors release patches in point releases (e.g., 4.6.7, 4.4.17) shortly after a vulnerability like this is disclosed. Test patches in a non-production lab environment with your organization's typical packet capture workflows before broad rollout. Prioritize updating analyst workstations and any automated traffic inspection systems that parse .pcap files.

Detection guidance

Detection is challenging because the crash is a local effect—no network signature or log entry clearly identifies exploitation. Monitor Wireshark application crashes or unexpected terminations, particularly if correlated with opening specific packet capture files. If possible, log Wireshark invocation with file paths to establish a timeline. Network-based detection would require identifying malformed 802.11 frames at the network edge, which is not practical for this vulnerability class. Threat hunting can review analyst file-access logs to identify suspicious .pcap transfers or downloads.

Why prioritize this

Despite a CVSS score of 5.5 (MEDIUM), this vulnerability deserves prompt attention because it directly targets security tools used in incident response. An attacker who can disrupt analysis workflows gains time and creates confusion. In a targeted attack scenario—such as an adversary who knows a security team is investigating them and sends a booby-trapped capture file—this becomes a denial-of-service weapon against your defense. The local attack vector and user interaction requirement prevent it from being a mass-exploitation risk, but the strategic targeting potential warrants expedited patching for security operations teams.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects the constraint that exploitation is local, requires user interaction, and only impacts availability (no confidentiality or integrity breach). The vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H indicates low attack complexity, no privilege escalation required, and high availability impact. This score is contextually appropriate but may underweight the operational risk to security teams; organizations should apply local risk factors when deciding priority.

Frequently asked questions