CVE-2026-15164: ciscodump Denial of Service Vulnerability

CVE-2026-15164 Overview

CVE-2026-15164 is a denial of service vulnerability affecting the ciscodump extcap utility bundled with Wireshark. The flaw impacts ciscodump versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. An attacker can trigger a crash in the utility, resulting in loss of packet capture availability. The Wireshark Foundation tracks the issue under advisory WNPA-SEC-2026-63 and Common Weakness Enumeration [CWE-122] (Heap-based Buffer Overflow). Exploitation requires local access and user interaction, which limits the practical attack surface to environments where analysts run ciscodump against attacker-influenced input.

Critical Impact
Successful exploitation crashes the ciscodump process and disrupts active packet captures, causing localized denial of service on analyst workstations and capture hosts.

Affected Products

Wireshark ciscodump versions 4.6.0 through 4.6.6
Wireshark ciscodump versions 4.4.0 through 4.4.16
Any Wireshark distribution that bundles the affected ciscodump extcap binary

Discovery Timeline

2026-07-08 - CVE-2026-15164 published to the National Vulnerability Database
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-15164

Vulnerability Analysis

The ciscodump utility is an extcap interface shipped with Wireshark. It captures traffic from Cisco devices over SSH by invoking the Embedded Packet Capture (EPC) feature. The vulnerability is classified as a heap-based buffer overflow under [CWE-122] and manifests during processing of capture input handled by ciscodump. Malformed or unexpected data reaching the parser corrupts heap memory and terminates the process.

The attack vector is local and requires user interaction. An analyst must launch ciscodump and connect it to input controlled or influenced by the attacker. The confidentiality and integrity impacts are none, while the availability impact is high because the process crashes.

The issue is limited to denial of service. There is no public evidence of code execution, and no exploit is currently available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is unsafe handling of parsed data within the ciscodump extcap binary, leading to a heap buffer overflow. See the GitLab Wireshark Work Item and Wireshark Security Advisory WNPA-SEC-2026-63 for the upstream analysis and patch commits.

Attack Vector

An attacker positions crafted input on a data source that a local user directs ciscodump to read. When the analyst starts the capture, ciscodump parses the malicious stream and crashes. Because the interaction happens on the analyst's own workstation, the impact is confined to that host and any in-progress captures. Refer to the vendor advisory for the specific parsing paths involved.

Detection Methods for CVE-2026-15164

Indicators of Compromise

Unexpected termination of the ciscodump process on analyst workstations or capture hosts
Wireshark extcap error dialogs referencing ciscodump failure during an active session
Operating system crash reports or core dumps generated by the ciscodump binary
Repeated launches of ciscodump against the same target immediately preceding crashes

Detection Strategies

Monitor process exit codes and abnormal termination events for the ciscodump binary across managed endpoints
Correlate Wireshark launch events with subsequent crash telemetry to identify targeted denial of service attempts
Inventory installed Wireshark versions and flag hosts running ciscodump in the affected ranges

Monitoring Recommendations

Ingest endpoint process telemetry and crash artifacts into a centralized data lake for cross-host analysis
Alert on ciscodump invocations that terminate within seconds of launch or produce core files
Track network destinations targeted by ciscodump sessions to identify suspicious or repeated capture attempts

How to Mitigate CVE-2026-15164

Immediate Actions Required

Identify all systems running Wireshark with ciscodump versions 4.6.0-4.6.6 or 4.4.0-4.4.16 and prioritize them for update
Upgrade Wireshark to a fixed release as documented in advisory WNPA-SEC-2026-63
Restrict analyst use of ciscodump against untrusted or attacker-influenced sources until patching is complete

Patch Information

The Wireshark Foundation has released fixed builds tracked in Wireshark Security Advisory WNPA-SEC-2026-63 and the associated GitLab Wireshark Work Item. Upgrade to the latest 4.6.x or 4.4.x maintenance release above the affected ranges.

Workarounds

Disable or remove the ciscodump extcap binary from Wireshark installations that do not require Cisco EPC captures
Limit execution of ciscodump to trusted, authenticated Cisco device sessions under analyst supervision
Enforce least privilege on analyst workstations so a crashed ciscodump process does not affect other capture workflows

bash

# Remove the ciscodump extcap binary on Linux installations where it is not needed
sudo rm /usr/lib/x86_64-linux-gnu/wireshark/extcap/ciscodump

# Verify installed Wireshark version
wireshark --version | head -n 1