CVE-2026-15163: Wireshark DOS Vulnerability

CVE-2026-15163 Overview

CVE-2026-15163 identifies multiple infinite loop conditions in protocol dissectors shipped with Wireshark 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. An attacker who convinces a user to open a crafted capture file, or who injects malformed traffic onto a monitored network segment, can trigger an infinite loop [CWE-835] inside the affected dissector. The result is CPU exhaustion and a denial of service against the Wireshark process. The flaw does not permit code execution or data disclosure, but it can disrupt incident response and network forensics workflows that rely on live or offline packet analysis.

Critical Impact
A malformed packet or capture file forces Wireshark dissectors into an infinite loop, exhausting CPU and rendering the analysis session unusable.

Affected Products

Wireshark 4.6.0 through 4.6.6
Wireshark 4.4.0 through 4.4.16
Bundled protocol dissectors referenced in Wireshark Security Advisory 2026-61

Discovery Timeline

2026-07-08 - CVE-2026-15163 published to the National Vulnerability Database (NVD)
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-15163

Vulnerability Analysis

The issue is classified under [CWE-835] (Loop with Unreachable Exit Condition). Multiple protocol dissectors in the Wireshark 4.4.x and 4.6.x branches fail to advance parsing offsets or terminate iteration when processing specific malformed field values. When Wireshark decodes such a packet, the dissector re-enters the same parsing state indefinitely and consumes all available CPU on the analysis host. The vulnerability requires user interaction, typically opening a crafted .pcap or .pcapng file, or applying live capture against attacker-controlled traffic. Confidentiality and integrity are not affected, but the availability impact on the Wireshark process is high. Related fixes are tracked across multiple GitLab work items, including #21275, #21277, #21330, and #21383.

Root Cause

Each affected dissector contains a parsing loop whose exit condition depends on values read from untrusted packet data. Crafted inputs set those fields such that the loop counter or offset never advances past the termination check. Because the affected code paths execute inside the main dissection thread, the loop blocks all further packet processing.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted capture file to an analyst, hosts it on a shared repository, or transmits malformed frames on a segment that a Wireshark instance is capturing. Opening the file or capturing the traffic triggers the vulnerable dissector path.

// No verified proof-of-concept code is published for CVE-2026-15163.
// Refer to Wireshark Security Advisory 2026-61 and the linked GitLab
// work items for dissector-specific fix details.

Detection Methods for CVE-2026-15163

Indicators of Compromise

Wireshark or tshark processes consuming a full CPU core for extended periods while parsing a specific capture file
Analyst reports of Wireshark becoming unresponsive immediately after opening a .pcap or .pcapng from an untrusted source
Capture files received via email, chat, or ticketing systems from external or unverified parties

Detection Strategies

Inventory analyst workstations and forensic hosts for Wireshark versions in the 4.6.0–4.6.6 and 4.4.0–4.4.16 ranges
Alert on sustained high CPU utilization by wireshark.exe, wireshark, or tshark processes
Flag capture files transferred into the environment from external sources for review before opening

Monitoring Recommendations

Track process telemetry from analyst endpoints for anomalous CPU consumption by Wireshark binaries
Log file-open events for .pcap and .pcapng files on forensic workstations
Correlate Wireshark process hangs with the file hash and origin of the capture being analyzed

How to Mitigate CVE-2026-15163

Immediate Actions Required

Upgrade Wireshark to a fixed release above 4.6.6 in the 4.6.x branch or above 4.4.16 in the 4.4.x branch, per Wireshark Security Advisory 2026-61
Restrict analysts from opening capture files received from untrusted sources until patches are applied
Isolate long-running live captures on affected versions from production analysis hosts

Patch Information

The Wireshark Foundation has published fixes referenced by advisory wnpa-sec-2026-61 and by GitLab work items #21275, #21277, #21330, and #21383. Each work item corrects the loop termination logic in a specific dissector. Install the latest 4.6.x or 4.4.x point release from the official Wireshark download channels.

Workarounds

Disable the affected dissectors through Wireshark's Analyze → Enabled Protocols menu until the host is patched
Use tshark with -–disable-protocol flags in automated pipelines to skip suspect dissectors
Open untrusted capture files only inside isolated virtual machines with limited CPU allocation

bash

# Skip a suspect dissector when analyzing an untrusted capture
tshark -r untrusted.pcapng --disable-protocol <protocol_short_name>

# Verify the installed Wireshark version before opening captures
wireshark --version