CVE-2026-15170: Wireshark Z39.50 Dissector DoS Vulnerability (Medium)

Technical summary

A buffer over-read vulnerability (CWE-122) exists in Wireshark's Z39.50 protocol dissector. The dissector fails to properly validate or bound-check packet data during parsing, leading to out-of-bounds memory access. When a specially crafted Z39.50 packet is processed—either through live packet capture or pcap file analysis—the memory violation causes an unhandled exception and application crash. The vulnerability is triggered only when the user actively initiates packet capture or opens a malicious pcap file, and requires the Z39.50 dissector to be active during traffic inspection.

Business impact

Wireshark downtime disrupts incident response workflows, network troubleshooting, and continuous monitoring capabilities. During active security investigations or network diagnostics, unexpected crashes can delay root-cause analysis and extend mean-time-to-resolution. Organizations relying on Wireshark for compliance logging or packet retention may experience gaps in audit trails if the application terminates unexpectedly. The impact is primarily operational rather than exposing sensitive data.

Affected systems

Affected versions are Wireshark 4.6.0–4.6.6 (current stable branch) and 4.4.0–4.4.16 (extended support branch). Organizations running other major versions (e.g., 4.2.x, 4.0.x, or 5.x) should verify their version numbers, as this advisory covers only the stated ranges. The vulnerability affects Wireshark on all operating systems (Windows, macOS, Linux) where these versions are deployed.

Exploitability

Exploitability is limited by attack prerequisites. An attacker must either (1) control network traffic that passes through a Wireshark capture session, or (2) deliver a malicious pcap file to a user who then opens it in Wireshark. Both scenarios require user action or network position. The local-access vector and requirement for user interaction (opening a file or actively capturing at the moment malicious traffic arrives) significantly reduces real-world exploitation likelihood compared to remote, unauthenticated vulnerabilities. No known public exploits or active weaponization have been reported.

Remediation

Update Wireshark to patched versions as released by the Wireshark Foundation. Verify the specific patched version numbers against the official Wireshark security advisory and release notes. As an interim measure, users can disable or uninstall the Z39.50 dissector plugin if Z39.50 analysis is not required, or restrict packet capture to trusted network segments. Do not share untrusted pcap files with colleagues using vulnerable versions.

Patch guidance

Consult the Wireshark Foundation's official security advisory for exact patched version numbers and download links. Patches are typically released for both the 4.6.x and 4.4.x branches. Test patches in a non-production environment before enterprise rollout, particularly if Wireshark integrations or automated packet processing scripts depend on specific version behavior. Automated update mechanisms (if available) can accelerate deployment.

Detection guidance

Monitor Wireshark process logs and system event logs for unexpected application crashes, particularly correlated with Z39.50 traffic analysis or pcap file loading. Deploy endpoint detection tools that alert on repeated application crashes on analyst workstations. If Z39.50 analysis is not used operationally, network segmentation or firewall rules can prevent Z39.50 traffic (typically port 210) from reaching analytical segments. Pcap file integrity checks and sandboxed analysis of untrusted captures can reduce exposure.

Why prioritize this

While the CVSS score of 5.5 (medium) reflects limited attack surface, the vulnerability affects a security-critical tool widely deployed in SOCs and incident response teams. Any disruption to Wireshark operations during active incidents has downstream consequences. Organizations should prioritize patching Wireshark in their standard update cycles but may deprioritize over vulnerabilities affecting internet-facing or authentication systems. The lack of active exploitation and KEV designation supports a measured, planned approach rather than emergency patching.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a high availability impact (A:H) but limited attack vector (L for local) and user interaction requirement (UI:R). No confidentiality or integrity impact is possible. The score correctly captures that while the vulnerability reliably crashes the application, the attacker must already have local access or network position, and the victim must be actively using Wireshark at the time of exploitation. This score is appropriate for an operational denial-of-service against a non-critical tool, though the actual business risk depends on organizational reliance on Wireshark.

Frequently asked questions