CVE-2025-1492: Wireshark DoS Vulnerability

CVE-2025-1492 Overview

CVE-2025-1492 is a denial of service vulnerability affecting the Bundle Protocol and CBOR (Concise Binary Object Representation) dissector components in Wireshark, the widely-used network protocol analyzer. The vulnerability allows attackers to crash Wireshark through packet injection or by tricking users into opening a specially crafted capture file, resulting in application termination and loss of ongoing capture or analysis sessions.

Critical Impact

Network security analysts and administrators using vulnerable Wireshark versions may experience unexpected application crashes during packet capture or analysis, disrupting critical network monitoring and forensic operations.

Affected Products

• Wireshark versions 4.4.0 to 4.4.3
• Wireshark versions 4.2.0 to 4.2.10
• Systems performing live packet capture or analyzing PCAP files containing malicious Bundle Protocol or CBOR data

Discovery Timeline

• 2025-02-20 - CVE-2025-1492 published to NVD
• 2025-04-10 - Last updated in NVD database

Technical Details for CVE-2025-1492

Vulnerability Analysis

This vulnerability is classified under CWE-674 (Uncontrolled Recursion), indicating that the Bundle Protocol and CBOR dissector components fail to properly limit recursive operations when parsing malformed or maliciously crafted network packets. When Wireshark processes packets containing nested or deeply recursive structures within Bundle Protocol or CBOR data, the dissector enters an uncontrolled recursive state that exhausts stack resources, ultimately causing the application to crash.

The network-accessible nature of this vulnerability is particularly concerning for security professionals who routinely analyze untrusted network traffic. An attacker can exploit this flaw without requiring any authentication or user interaction beyond the victim opening a malicious capture file or capturing packets on a network segment where the attacker can inject traffic.

Root Cause

The root cause lies in the Bundle Protocol and CBOR dissector implementations within Wireshark's protocol parsing engine. These dissectors lack adequate safeguards against deeply nested or recursive data structures. CBOR, being a self-describing data format, allows for arbitrary nesting of maps and arrays, and without proper recursion depth limits, processing such structures leads to stack exhaustion.

The dissector code processes each nested element through recursive function calls without implementing a maximum depth counter or iterative parsing approach, making it susceptible to stack overflow conditions when encountering adversarial input.

Attack Vector

Exploitation of CVE-2025-1492 can occur through two primary attack vectors:

Packet Injection: An attacker on the same network segment as the victim can inject malicious packets containing crafted Bundle Protocol or CBOR data. When Wireshark captures and attempts to dissect these packets, the uncontrolled recursion is triggered, crashing the application.

Crafted Capture File: An attacker can distribute a malicious PCAP or PCAPNG capture file containing the exploit payload. When an analyst opens this file in a vulnerable Wireshark version, the dissector crash occurs during file parsing.

The attack requires no privileges on the target system and no user interaction beyond standard Wireshark usage patterns (capturing packets or opening capture files). For technical details, see the GitLab Issue #20373 and the Wireshark Security Advisory WNPA-SEC-2025-01.

Detection Methods for CVE-2025-1492

Indicators of Compromise

• Unexpected Wireshark application crashes during packet capture or file analysis operations
• System logs showing stack overflow or segmentation fault errors associated with Wireshark processes
• Presence of PCAP/PCAPNG files with unusual deeply nested CBOR structures
• Network traffic containing malformed Bundle Protocol packets with excessive nesting

Detection Strategies

• Monitor Wireshark process stability and implement alerting on repeated crashes during analysis sessions
• Deploy network intrusion detection rules to identify anomalous Bundle Protocol or CBOR traffic patterns
• Implement file integrity monitoring to detect suspicious capture files introduced into analysis environments
• Use application crash monitoring tools to correlate Wireshark crashes with specific capture files or network segments

Monitoring Recommendations

• Establish baseline metrics for Wireshark process stability in your environment
• Configure endpoint detection to alert on Wireshark processes terminating unexpectedly
• Review system event logs for crash dump files associated with Wireshark to identify potential exploitation attempts
• Monitor for users opening capture files from untrusted sources

How to Mitigate CVE-2025-1492

Immediate Actions Required

• Upgrade Wireshark to version 4.4.4 or later for the 4.4.x branch
• Upgrade Wireshark to version 4.2.11 or later for the 4.2.x branch
• Audit systems to identify all Wireshark installations running vulnerable versions
• Restrict access to untrusted capture files until patching is complete

Patch Information

Wireshark has released patched versions that address the uncontrolled recursion vulnerability in the Bundle Protocol and CBOR dissectors. Organizations should update to Wireshark 4.4.4 or 4.2.11 (or later) depending on their deployment branch. Detailed patch information and release notes are available in the Wireshark Security Advisory WNPA-SEC-2025-01.

The fix implements proper recursion depth limits in the affected dissectors to prevent stack exhaustion when processing malicious input.

Workarounds

• Disable the Bundle Protocol and CBOR dissectors if not required for your analysis workflows: Navigate to Analyze → Enabled Protocols and uncheck the relevant dissectors
• Avoid opening capture files from untrusted sources until systems are patched
• Limit live capture operations on untrusted network segments when using vulnerable versions
• Consider using Wireshark in isolated environments (VMs or containers) when analyzing potentially malicious captures

# Disable vulnerable dissectors via command line
wireshark --disable-protocol bpsec --disable-protocol cbor

# Verify Wireshark version
wireshark --version

# Update Wireshark on Debian/Ubuntu systems
sudo apt update && sudo apt install wireshark

# Update Wireshark on RHEL/CentOS systems
sudo yum update wireshark