CVE-2026-15165 Overview
CVE-2026-15165 is a denial of service vulnerability in the Wireshark TLS Encrypted Client Hello (ECH) decryptor. The flaw affects Wireshark versions 4.6.0 through 4.6.6 and is classified as a heap-based buffer overflow [CWE-122]. An attacker can crash the Wireshark process by supplying a crafted capture file or network traffic that the TLS dissector attempts to parse. Exploitation requires local access and user interaction, such as opening a malicious .pcap file. The issue is tracked in Wireshark Security Advisory WNPA-SEC-2026-56 and GitLab Work Item #21390.
Critical Impact
A malformed TLS ECH packet triggers a heap buffer overflow in the Wireshark dissector, terminating the analysis session and interrupting incident response workflows.
Affected Products
- Wireshark 4.6.0
- Wireshark 4.6.1 through 4.6.5
- Wireshark 4.6.6
Discovery Timeline
- 2026-07-08 - CVE-2026-15165 published to NVD
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-15165
Vulnerability Analysis
The vulnerability resides in the Wireshark TLS dissector responsible for parsing the Encrypted Client Hello (ECH) extension introduced in modern TLS 1.3 deployments. When the decryptor processes a crafted ECH payload, a heap-based buffer overflow occurs and terminates the Wireshark process. The result is a denial of service against the analyst workstation running Wireshark or tshark.
Exploitation requires a user to open a malicious packet capture file or observe crafted traffic while live-capturing with TLS dissection enabled. The vulnerability does not expose confidentiality or integrity of data on the host, but it interrupts network forensics and monitoring activities. Because Wireshark is heavily used during incident response, adversaries can weaponize this bug to disrupt investigation into concurrent attacks.
Root Cause
The flaw is a heap buffer overflow [CWE-122] in the TLS ECH decryption routine. The dissector fails to validate the length of an attacker-controlled field before copying bytes into a heap allocation, causing memory corruption and a process crash. See the GitLab Work Item #21390 for the reproducer and code path.
Attack Vector
The attack vector is local. An attacker crafts a .pcap or .pcapng file containing a malformed TLS ECH handshake and delivers it to a target analyst through email, shared storage, or a threat intelligence feed. Opening the file in a vulnerable Wireshark build triggers the crash. Live-capture scenarios are also affected when the crafted TLS traffic traverses a monitored interface.
No verified public exploit code is available. Refer to the Wireshark Security Advisory WNPA-SEC-2026-56 for technical details on the affected code path.
Detection Methods for CVE-2026-15165
Indicators of Compromise
- Unexpected termination of wireshark.exe, tshark, or dumpcap processes on analyst workstations.
- Windows Error Reporting or Linux coredump entries referencing the Wireshark TLS dissector module.
- Packet capture files received from untrusted sources containing anomalous TLS ClientHello ECH extensions.
Detection Strategies
- Inventory endpoints for Wireshark installations between versions 4.6.0 and 4.6.6 using software asset management or endpoint telemetry.
- Alert on repeated Wireshark process crashes within short intervals, which may indicate targeted delivery of crafted captures.
- Scan email gateways and file shares for .pcap and .pcapng attachments originating from external senders.
Monitoring Recommendations
- Correlate application crash events with recent file-open activity in Wireshark to identify malicious captures.
- Log and review analyst workstation activity during active incident response, when disruption of Wireshark has the greatest operational impact.
- Track Wireshark version distribution over time to confirm remediation coverage.
How to Mitigate CVE-2026-15165
Immediate Actions Required
- Upgrade Wireshark to a fixed release published in WNPA-SEC-2026-56 on all analyst workstations and forensic appliances.
- Instruct analysts to avoid opening packet captures received from untrusted or unverified sources until patching is complete.
- Isolate forensic analysis of untrusted captures to dedicated, non-production virtual machines.
Patch Information
The Wireshark Foundation has released a fixed version addressing the heap overflow in the TLS ECH decryptor. Consult the Wireshark Security Advisory WNPA-SEC-2026-56 for the specific patched release and download links. Package maintainers for Linux distributions should apply the upstream fix referenced in GitLab Work Item #21390.
Workarounds
- Disable the TLS protocol dissector in Wireshark preferences under Analyze > Enabled Protocols if upgrading is not immediately possible.
- Use tshark with the --disable-protocol tls flag when processing untrusted capture files.
- Restrict Wireshark usage to sandboxed environments until the patched release is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
