CVE-2026-15167: Wireshark DBS Etherwatch Parser Denial of Service Vulnerability

Technical summary

This vulnerability stems from a stack-based buffer overflow (CWE-121) in Wireshark's DBS Etherwatch file parser. The flaw allows an attacker to craft a malicious DBS Etherwatch formatted file that, when parsed by a vulnerable version of Wireshark, writes beyond the bounds of a stack-allocated buffer. The resulting memory corruption crashes the process without requiring authentication, user interaction beyond file opening, or network privileges—the attack surface is purely local file access. The CVSS 3.1 score of 7.5 (HIGH) reflects the high availability impact and low complexity of exploitation.

Business impact

For security teams relying on Wireshark for packet analysis, incident response, and forensic investigations, this vulnerability introduces operational risk. An adversary could disrupt analysis workflows by distributing malicious Etherwatch files that crash the tool at critical moments. In environments where Wireshark is part of automated or semi-automated analysis pipelines, exploitation could corrupt analytical processes or force manual workarounds. The severity is moderated by the fact that the vulnerability impacts availability only, not confidentiality or integrity of other systems or data.

Affected systems

Wireshark versions 4.6.0, 4.6.1, 4.6.2, 4.6.3, 4.6.4, 4.6.5, 4.6.6 (current 4.6 branch) and 4.4.0 through 4.4.16 (current 4.4 branch) are vulnerable. Wireshark 4.8 and newer versions, as well as earlier branches (4.2 and before), are not affected based on the stated version range. Organizations must verify their deployed Wireshark versions and prioritize patching or updating affected instances.

Exploitability

Exploitability is high from a practical standpoint. The attack requires only that an attacker deliver a crafted DBS Etherwatch file to a system running vulnerable Wireshark and that a user open it. No network access, credentials, or user interaction beyond file opening is needed. However, real-world impact depends on the prevalence of DBS Etherwatch file handling in your environment and the likelihood of users opening untrusted files. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation has not yet been observed or reported at scale.

Remediation

Upgrade to the latest patch versions available for your Wireshark branch: for the 4.6 branch, upgrade to 4.6.7 or later; for the 4.4 branch, upgrade to 4.4.17 or later. Alternatively, upgrade to Wireshark 4.8 or later if your environment supports it. Until patching is complete, restrict file parsing of untrusted DBS Etherwatch files and educate users not to open such files from unknown sources. Organizations unable to update immediately should consider disabling Etherwatch file support if operationally feasible.

Patch guidance

Verify available patches against official Wireshark release notes and security advisories. The vulnerability affects the 4.6 and 4.4 branches; check your current version with 'wireshark --version' and compare against the published patch versions. Wireshark provides binary installers and package manager updates for most platforms (Windows, macOS, Linux). Test patches in a non-production environment first to ensure compatibility with your analysis workflows. Monitor Wireshark's security page for any subsequent releases addressing related issues in the parser.

Detection guidance

Monitor for unexpected Wireshark process crashes, especially when processing DBS Etherwatch files (.dbs extensions or similar). Implement file integrity monitoring or sandboxing for untrusted network captures or exported files. Log and alert on Wireshark failures in your SIEM if available. Consider restricting file opening permissions in Wireshark where technically possible, or implementing endpoint controls to prevent execution of Wireshark on untrusted file paths. Forensic analysis of crash dumps may help identify if exploitation occurred.

Why prioritize this

Assign this a HIGH priority for patch management because the vulnerability has a 7.5 CVSS score, requires no authentication or user privilege elevation, and affects widely deployed software used in security operations. However, real-world urgency depends on your organization's use of Wireshark and exposure to untrusted DBS Etherwatch files. If Wireshark is critical to your incident response or monitoring capabilities, prioritize patching within your standard maintenance windows. The lack of KEV listing suggests this is not yet a widespread active threat, allowing for some flexibility in scheduling.

Risk score, explained

The CVSS 3.1 score of 7.5 HIGH reflects: (1) network-accessible attack vector (AV:N) due to the file parsing nature allowing remote delivery, (2) low attack complexity (AC:L) requiring only a crafted file, (3) no privilege requirement (PR:N) or user interaction beyond file open (UI:N), (4) no scope change (S:U), and (5) high availability impact (A:H) from process crash. The score does not account for confidentiality or integrity impact because the overflow does not leak data or modify other systems. Real-world risk remains context-dependent based on file handling practices and Wireshark's role in your operations.

Frequently asked questions