CVE-2026-15174: Wireshark Catapult DCT2000 Dissector DoS Vulnerability

Technical summary

CVE-2026-15174 is a buffer overflow vulnerability (CWE-122) in the Catapult DCT2000 protocol dissector within Wireshark. The flaw allows an attacker to craft specially malformed packets that, when dissected by the vulnerable versions, trigger out-of-bounds memory access and cause the application to crash. The vulnerability requires local or adjacent network access and user interaction (opening a packet capture file or live network session), but does not require elevated privileges. The crash is a denial-of-service condition; no code execution, data theft, or privilege escalation is possible via this vulnerability.

Business impact

For security analysts and SOC teams, this vulnerability creates operational risk during active investigations. If a threat actor deliberately injects malformed Catapult DCT2000 packets into network traffic or embeds them in a capture file, analysts using vulnerable Wireshark versions will lose their analysis session unexpectedly. In critical incident response scenarios, this disruption can slow triage and evidence collection. Wireshark is not typically a direct internet-facing service, so external attackers cannot exploit it remotely; the threat is primarily from compromised network segments or supply-chain scenarios where crafted packets are delivered via email or file sharing.

Affected systems

Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16 are vulnerable. This includes stable and LTS release branches. Wireshark 4.6.7 and later, as well as 4.4.17 and later, are presumed patched (verify against the vendor advisory). Wireshark 4.2.x and earlier branches are outside the affected range. Any deployment running these versions on Windows, macOS, or Linux is at risk if analysts process untrusted or adversary-controlled network captures or live traffic containing Catapult DCT2000 packets.

Exploitability

Exploiting this vulnerability is straightforward in terms of mechanics: an attacker needs only to craft a malformed Catapult DCT2000 packet and introduce it into a packet capture or live network stream. However, exploitability in practice is limited by the requirement that a user must actively open or monitor that traffic in Wireshark. The attack does not propagate automatically and requires either direct file delivery (phishing a .pcap file) or the ability to inject packets into an adjacent network segment. The CVSS score of 5.5 (MEDIUM) reflects this combination of high impact (application crash) but low attack complexity and local/network scope. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no active, widespread exploitation has been publicly documented.

Remediation

Update Wireshark to version 4.6.7 or later, or to version 4.4.17 or later, depending on your release branch. Both patches resolve the buffer overflow in the Catapult DCT2000 dissector. Organizations should prioritize patching analyst workstations and any centralized packet analysis appliances. If immediate patching is not possible, consider disabling or filtering Catapult DCT2000 traffic at network boundaries, or restricting Wireshark usage to trusted packet captures only.

Patch guidance

Verify the exact patched version numbers against the official Wireshark security advisory (wireshark.org). For most environments, upgrading to the latest stable release in your branch is recommended. Wireshark auto-update features on Windows and macOS should be enabled. Linux distributions package Wireshark separately; check your distro's repository for patched versions. After patching, consider re-opening any previously untrusted packet captures to confirm they no longer crash the application.

Detection guidance

Monitor Wireshark process crashes in your environment via endpoint telemetry or application logs. If Wireshark terminates unexpectedly while processing network captures, correlation with Catapult DCT2000 traffic is a signal that this vulnerability may have been triggered. Network-level detection is difficult without examining packet payloads for Catapult DCT2000 markers, but egress filtering of uncommon protocols can help. Maintain logs of which users or systems process sensitive network captures to correlate crashes with specific incident response activities.

Why prioritize this

Although this is a MEDIUM-severity vulnerability with limited attack surface, it should be prioritized for remediation because: (1) Wireshark is critical infrastructure for threat detection and incident response; (2) a denial-of-service during an active investigation is operationally damaging; (3) patching is straightforward and low-risk; (4) the affected versions are in active use in many enterprises. Schedule patching within standard change windows but do not defer indefinitely.

Risk score, explained

The CVSS 3.1 score of 5.5 reflects a vulnerability that causes high availability impact (denial of service) but requires user interaction and local/adjacent network access. The vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates: attack vector is local or adjacent (not remote over the internet), attack complexity is low (malformed packets are simple to craft), no special privileges are needed, user interaction is required (analyst must open the file or view the live stream), scope is unchanged (impact is limited to Wireshark itself), and there is no confidentiality or integrity impact, only availability loss. This places it solidly in the MEDIUM range—notable but not critical.

Frequently asked questions