CVE-2026-15173: Wireshark pcapng Parser Denial of Service (MEDIUM)

Technical summary

The vulnerability stems from a buffer-related memory safety issue (CWE-122) in Wireshark's pcapng file parsing logic. When processing a malicious or malformed pcapng file, the parser fails to properly validate or bound memory operations, triggering a crash. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates local attack vector, high complexity (requiring specific file structure and user interaction), no privilege requirement, user interaction required, and high availability impact with no scope expansion or confidentiality/integrity consequences.

Business impact

For organizations relying on Wireshark for network analysis and troubleshooting, this vulnerability creates operational friction: legitimate pcapng files from potentially compromised networks or untrusted sources could cause analyst tools to crash mid-investigation. While not leading to data theft or system compromise, unplanned crashes disrupt incident response workflows and can delay detection and analysis activities. The impact is localized to individual analyst workstations rather than systemic.

Affected systems

Wireshark versions 4.6.0, 4.6.1, 4.6.2, 4.6.3, 4.6.4, 4.6.5, and 4.6.6 are affected. Organizations using Wireshark outside this version range (including 4.4.x, 4.2.x, or 4.8.x and later if patched) are not affected by this specific issue. This is a relatively narrow version window, suggesting a regression or newly introduced flaw rather than a longstanding design issue.

Exploitability

Exploitability is low in practice. The attack requires user interaction (opening a file), local file access, and a carefully crafted pcapng input. An attacker cannot remotely trigger the crash or exploit it over the network. The high complexity rating indicates that triggering the crash reliably may require precise file structure knowledge. This is not a wormable or automatically exploitable vulnerability—it requires social engineering or supply-chain delivery of a malicious pcapng file.

Remediation

Users should upgrade Wireshark to a version newer than 4.6.6. Verify the specific patched version against the official Wireshark release notes and security advisories. In the interim, users should exercise caution when opening pcapng files from untrusted or unexpected sources, particularly during active incident response. Network packet capture and analysis can often be re-run on fresh tooling or alternate systems if a crash occurs.

Patch guidance

Consult the official Wireshark security advisory and release notes to identify the minimum version that resolves CVE-2026-15173. The vulnerability affects a narrow version band (4.6.0–4.6.6), so patching decisions depend on your current deployment version. If you are on 4.4.x or 4.2.x, this CVE does not apply; confirm patch applicability before deploying. Test the upgrade in a non-production environment to ensure compatibility with your capture workflows and any dependent scripts or automation.

Detection guidance

Monitor Wireshark process crashes and audit logs for unexpected terminations. Organizations deploying Wireshark across multiple analyst workstations should inventory the installed versions to identify affected systems. Look for Wireshark crashes triggered by pcapng file opens in endpoint telemetry or syslog. Consider implementing file type restrictions or sandboxing for pcapng files from external sources. If Wireshark is deployed in a centralized capacity, prioritize patching those systems first.

Why prioritize this

This is a MEDIUM severity denial-of-service issue with low exploitability. It merits timely patching but does not require emergency response. Organizations should include it in their regular patch cycle, prioritizing systems where analysts frequently process untrusted captures or where downtime in analysis workflows has direct business impact. The lack of data compromise and remote exploitation potential makes this lower priority than critical remote code execution vulnerabilities, but it should not be deferred indefinitely.

Risk score, explained

The CVSS 4.7 score reflects high availability impact (crash) offset by multiple mitigating factors: local-only attack vector, no privilege escalation, requirement for user interaction and file placement, and high complexity in reliable exploitation. The score appropriately captures that while the impact is complete (denial of service), the attack surface and likelihood are constrained. This is not a trivial flaw, but it is fundamentally different in risk profile from remote network-based vulnerabilities.

Frequently asked questions