CVE-2026-15169: Wireshark UMTS FP Protocol Dissector Denial of Service

Technical summary

CVE-2026-15169 is a buffer-related vulnerability (CWE-122) in the UMTS FP (Frame Protocol) dissector component of Wireshark. The vulnerability allows an unauthenticated local user to cause a crash via a maliciously crafted UMTS packet. The dissector fails to properly validate or handle the packet structure, resulting in memory access violations that crash the Wireshark process. The vulnerability requires user interaction—specifically, the user must open or process a malicious UMTS packet capture file or receive the packet via a live capture that they are actively analyzing.

Business impact

Organizations relying on Wireshark for network traffic analysis, protocol troubleshooting, or security monitoring face operational disruption if users encounter malicious UMTS packets. In environments where Wireshark is used for incident response or forensic analysis, a crash could interrupt critical investigations. The impact is primarily availability-focused; there is no data confidentiality or integrity compromise. However, the interruption could delay network diagnostics or security assessments at a critical moment.

Affected systems

Wireshark versions 4.6.0, 4.6.1, 4.6.2, 4.6.3, 4.6.4, 4.6.5, and 4.6.6 are affected, as are versions 4.4.0 through 4.4.16. Any system running these versions of Wireshark that processes UMTS network traffic is vulnerable. Organizations using Wireshark in laboratory, production monitoring, or forensic environments should audit their deployments to identify affected instances.

Exploitability

Exploitability is low to moderate. An attacker must either convince a user to open a malicious packet capture file or deliver a crafted UMTS packet into an active network capture that a user is monitoring. The UMTS protocol is primarily used in cellular and telecommunications infrastructure, limiting exposure in typical enterprise environments. However, organizations with telecommunications monitoring, 3G/4G protocol analysis, or security research labs are at higher risk. The vulnerability requires no elevated privileges and no network access requirements beyond the local system; the barrier is primarily in crafting the malicious packet and delivering it to a Wireshark user.

Remediation

Update Wireshark to a patched version. For the 4.6.x branch, upgrade to version 4.6.7 or later. For the 4.4.x branch, upgrade to version 4.4.17 or later. Verify the exact patch version against Wireshark's official security advisory and release notes. Organizations unable to patch immediately should restrict access to Wireshark deployments, disable the UMTS dissector if not needed, or avoid processing untrusted packet captures.

Patch guidance

Wireshark provides automated updates through standard package managers on most platforms. On Windows, use the built-in updater or download the latest installer from wireshark.org. On Linux, update via your distribution's package repository (apt, yum, etc.). On macOS, use Homebrew or the official macOS installer. Verify the installed version post-update by checking Help > About Wireshark. Test the update in a non-production environment first to ensure compatibility with any custom dissectors or plugins in your deployment.

Detection guidance

Monitor for Wireshark crashes or unexpected terminations when processing UMTS traffic. Enable application logging to capture crash dumps and analyze them for the UMTS dissector stack trace. Network-level detection is difficult since the attack relies on application-layer protocol parsing, but packet content inspection for malformed UMTS FP headers may provide signals. Establish baseline monitoring of Wireshark process stability and alert on abnormal terminations. In security labs, consider sandboxing Wireshark instances or isolating them on test networks to limit the blast radius of a crash.

Why prioritize this

This vulnerability merits prompt attention due to its high availability impact in affected environments. While the CVSS score of 5.5 (Medium) reflects the local attack vector and lack of data compromise, the practical risk depends on your organization's use of Wireshark and UMTS protocol exposure. Telecommunications companies, protocol research teams, and security operations centers analyzing 3G/cellular traffic should prioritize patching. General enterprises with Wireshark used only for occasional TCP/IP analysis face lower risk but should still apply the patch as part of routine maintenance.

Risk score, explained

The CVSS 3.1 score of 5.5 (Medium) is driven by: (1) Local attack vector (AV:L)—the attacker must have local access or convince a user to process the malicious packet; (2) Low attack complexity (AC:L)—crafting the packet requires knowledge of UMTS protocol but no exploitation obstacles; (3) No privileges required (PR:N); (4) User interaction required (UI:R)—the user must open or process the packet; (5) High availability impact (A:H)—the dissector crash denies service. The score excludes confidentiality and integrity impact, as the vulnerability does not leak data or corrupt files.

Frequently asked questions