CVE-2026-15171: Wireshark SSH Dissector Denial-of-Service Vulnerability

Technical summary

CVE-2026-15171 is a null pointer dereference (CWE-476) in Wireshark's SSH protocol dissector. When the dissector encounters malformed SSH packets during live capture or file analysis, it fails to validate a pointer before dereferencing it, causing the application to crash. The vulnerability is triggered through user interaction—specifically, when a user opens a crafted SSH packet file or captures traffic containing malicious SSH frames. The attack surface is limited to the local machine where Wireshark is running, and exploitation requires no elevated privileges. The issue was patched across both affected release branches (4.4.x and 4.6.x) to restore proper input validation in the SSH dissector logic.

Business impact

For security teams relying on Wireshark for packet analysis, forensic investigation, or troubleshooting, this vulnerability introduces operational risk. An analyst could lose work if a malicious pcap file is opened without saving first. In environments where Wireshark is deployed as part of automated packet capture and analysis pipelines, a crafted SSH packet could cause service interruption. However, the impact is confined to availability; no sensitive data exposure or lateral movement risk exists. Organizations should prioritize patching based on their Wireshark deployment model and the likelihood of handling untrusted packet capture files.

Affected systems

Affected versions: Wireshark 4.6.0–4.6.6 and Wireshark 4.4.0–4.4.16. This covers both the 4.6 branch (recently released) and the 4.4 long-term support branch. Any deployment running these versions is potentially vulnerable if users open or analyze untrusted pcap files or connect to networks where malicious SSH traffic could be captured. The vulnerability does not affect Wireshark 4.2.x, 4.0.x, or earlier versions, nor does it impact versions 4.8.0 and later (verify against the vendor advisory for the exact patched versions).

Exploitability

Exploitability is moderate and hindered by practical constraints. An attacker would need to either (1) craft a malicious pcap file and trick a user into opening it in Wireshark, or (2) inject malformed SSH packets into a network that a user is passively monitoring with Wireshark. The former requires social engineering; the latter requires network access or compromise. No authentication is required, and the vulnerable code executes in the context of the user running Wireshark (typically unprivileged). Publicly available exploits are unlikely because the crash is straightforward to trigger but not easily weaponized for code execution. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no widespread active exploitation has been observed.

Remediation

Update Wireshark to the latest patched version for your release branch. Users on the 4.6.x branch should upgrade to 4.6.7 or later; those on 4.4.x (LTS) should upgrade to 4.4.17 or later (verify these version numbers against the vendor release notes). In the interim, minimize the opening of untrusted pcap files, and configure network monitoring to avoid capturing or analyzing SSH traffic from untrusted sources. No workarounds short of patching are available to prevent the crash.

Patch guidance

Check your current Wireshark version (Help > About Wireshark). If you are running 4.6.0–4.6.6 or 4.4.0–4.4.16, update immediately using your organization's software distribution mechanism or via Wireshark's built-in update checker. Verify the patched version against the official Wireshark security advisory to confirm the fix. For automated deployments, test the patched version in a staging environment before rolling out to ensure compatibility with your packet capture workflows and third-party integrations.

Detection guidance

Monitor Wireshark process crashes on endpoints where it is deployed. If a crash occurs while processing SSH traffic, correlate the timing with pcap files opened or network segments monitored. Review crash logs and core dumps if available to confirm SSH dissector involvement. Endpoint detection and response (EDR) tools should flag unexpected Wireshark crashes as a potential indicator of exploitation, though the benign explanation (user error, corrupted file) is also common. Network monitoring will not detect the malicious SSH frames themselves but can identify when Wireshark instances unexpectedly disconnect or restart.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS score of 5.5 (Medium) reflects limited exploitability and no confidentiality or integrity impact. The risk is further reduced by the CISA KEV exclusion and the local attack surface. However, security teams should prioritize patching if they regularly analyze untrusted pcaps, work in high-turnover environments where social engineering is a concern, or operate Wireshark on shared systems. Teams that monitor only internal, trusted networks and carefully vet packet files can defer patching with acceptable risk.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a Medium severity. The vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates: local attack vector (AV:L, not remotely exploitable), low attack complexity (AC:L, any user can trigger it), no privilege requirement (PR:N), but requires user interaction (UI:R—opening a file or observing live capture). There is no impact on confidentiality (C:N) or integrity (I:N), but high impact on availability (A:H) when the crash occurs. The score does not escalate to High because the scope is unchanged (local process crash only) and the barrier to exploitation is the user interaction requirement.

Frequently asked questions