CVE-2026-15172: Wireshark FMP/NOTIFY Dissector Denial of Service Vulnerability

Technical summary

CVE-2026-15172 is a dissector crash vulnerability in Wireshark's FMP/NOTIFY protocol handler. The vulnerability is triggered during packet processing when malformed or adversarially crafted protocol data is parsed. The crash occurs in user context and does not result in code execution or data exfiltration, only denial of service. The issue stems from improper handling of protocol state or data validation (CWE-606: Untrusted Search Path). The vulnerability affects Wireshark 4.6.x up to version 4.6.6 and the 4.4.x branch through 4.4.16, with CVSS 3.1 score 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), indicating local attack vector, low complexity, user interaction required, and high availability impact.

Business impact

Organizations using Wireshark for network troubleshooting, security analysis, or threat investigation could experience service disruptions if analysts open or process malicious capture files. This affects incident response teams, network engineers, and security operations centers that rely on Wireshark for real-time or forensic packet analysis. The impact is primarily operational—temporary loss of analysis capability—rather than a breach of confidentiality or integrity. However, repeated or timed crashes could disrupt critical troubleshooting during active security incidents.

Affected systems

The vulnerability affects Wireshark versions 4.6.0, 4.6.1, 4.6.2, 4.6.3, 4.6.4, 4.6.5, and 4.6.6; and versions 4.4.0 through 4.4.16 in the 4.4.x series. All platforms and architectures running these versions are at risk. Users on stable release branches outside these ranges (e.g., 4.2.x, 4.8.x when released) should verify their version and update accordingly if running an affected version.

Exploitability

Exploitation requires local system access and user interaction—specifically, the victim must open or analyze a malicious network capture file (.pcap, etc.) or process adversarial traffic in real time. An attacker cannot remotely trigger the crash over the network alone; they must deliver the malicious input through a file or by positioning themselves on the network path (man-in-the-middle). The barrier to exploitation is low given Wireshark's common use in handling untrusted capture files during investigations. The vulnerability is not listed in the CISA KEV catalog, suggesting no evidence of active in-the-wild exploitation at publication.

Remediation

Patch to a version beyond the affected ranges. For the 4.6.x branch, upgrade to 4.6.7 or later. For the 4.4.x branch, upgrade to 4.4.17 or later. Verify the specific patch version against the Wireshark security advisory to confirm the fix is included. Until patching is feasible, limit analysis of untrusted or suspicious network captures to isolated lab environments or sandboxed instances, and restrict Wireshark access to trusted users only.

Patch guidance

Check the Wireshark project's official release notes and security advisories for the exact patched versions. Organizations should test patches in a non-production environment before widespread deployment to ensure compatibility with existing workflows and capture file formats. Wireshark updates are typically straightforward binary replacements on Windows, macOS, and Linux systems. Consider coordinating updates with network and security teams to avoid analysis capability gaps during the update window.

Detection guidance

Monitor for Wireshark process crashes or unexpected terminations, particularly in logs from security operations, network engineering, or incident response systems. Detection is reactive—crashes will manifest as application failures rather than suspicious activities that trigger alerts. Consider implementing endpoint monitoring to track Wireshark process lifecycle events and correlate crashes with file or network access patterns. Log analysis systems can flag repeated crashes on the same system, which might indicate attempted exploitation or accidental malicious file handling.

Why prioritize this

This vulnerability merits prompt but not emergency patching. The CVSS score of 5.5 (MEDIUM) reflects low attack complexity and high availability impact, but exploitation requires user interaction and local access. Prioritize patching based on your organization's risk tolerance for tool unavailability and the likelihood of staff handling untrusted capture files. Teams that frequently investigate external malware samples, process captures from adversary systems, or participate in threat hunts should patch sooner. Teams using Wireshark only on known-good, controlled network segments can accept slightly longer remediation timelines.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects: Attack Vector Local (network capture files must be opened locally), Attack Complexity Low (no special conditions required to trigger), Privileges Required None (no special rights needed), User Interaction Required (user must open or process the malicious data), Scope Unchanged (impact limited to the Wireshark process), Confidentiality None, Integrity None, Availability High (process crash). The 'High' availability impact drives the score above 5.0 despite the local attack vector and user interaction requirement. This is a classic denial-of-service vulnerability with moderate real-world risk.

Frequently asked questions