CVE-2026-15167: Wireshark DBS Etherwatch DoS Vulnerability

CVE-2026-15167 Overview

CVE-2026-15167 is a denial-of-service vulnerability in the DBS Etherwatch file parser shipped with Wireshark. The flaw affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. An attacker can trigger a crash by supplying a crafted DBS Etherwatch capture file to a vulnerable Wireshark instance. The issue is tracked under [CWE-121] Stack-based Buffer Overflow and is documented in Wireshark Security Advisory WNPA-SEC-2026-62. Successful exploitation forces Wireshark to terminate, disrupting network analysis workflows for incident responders and network engineers.

Critical Impact
Remote, unauthenticated attackers can crash Wireshark by delivering a malicious DBS Etherwatch capture file, resulting in a denial-of-service condition against the analyst workstation.

Affected Products

Wireshark 4.6.0 through 4.6.6
Wireshark 4.4.0 through 4.4.16
DBS Etherwatch file parser component

Discovery Timeline

2026-07-08 - CVE-2026-15167 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-15167

Vulnerability Analysis

The vulnerability resides in Wireshark's DBS Etherwatch capture file parser. Wireshark supports numerous legacy capture formats, and each parser reconstructs packet records from file-supplied length and structure fields. The DBS Etherwatch parser fails to safely bound data written to a stack-allocated buffer while processing malformed input. The condition is classified as [CWE-121] Stack-based Buffer Overflow. In Wireshark's parser architecture the resulting memory corruption manifests as an application crash, producing a denial-of-service outcome rather than code execution. The advisory WNPA-SEC-2026-62 and GitLab Work Item #21352 document the affected code path and fix.

Root Cause

The root cause is insufficient validation of length or field values read from a DBS Etherwatch file before those values drive writes into a fixed-size stack buffer. When a crafted file supplies out-of-range values, the parser writes past the buffer boundary and corrupts stack state, triggering an abort.

Attack Vector

An attacker delivers a crafted DBS Etherwatch capture file to a target analyst. Common delivery paths include email attachments, shared file repositories, malicious download links, or capture files pulled from untrusted sources. Opening the file in Wireshark, or letting an automated pipeline pass it to tshark, triggers the crash. No authentication or user privilege on the target is required beyond opening the file.

No verified public exploit code is available for CVE-2026-15167. Refer to the vendor advisory for the technical description of the affected parsing routine.

Detection Methods for CVE-2026-15167

Indicators of Compromise

Unexpected crashes or termination of wireshark, tshark, or dumpcap processes on analyst workstations.
Presence of DBS Etherwatch capture files (.txt traces containing DBS Etherwatch headers) originating from untrusted sources.
Core dumps or Windows Error Reporting entries referencing Wireshark's wiretap module.

Detection Strategies

Inventory Wireshark installations and flag hosts running versions 4.6.0–4.6.6 or 4.4.0–4.4.16.
Alert on repeated crash events from Wireshark binaries within short time windows, which may indicate parser abuse.
Inspect email and file-sharing gateways for capture files delivered from external sources to analyst mailboxes.

Monitoring Recommendations

Forward endpoint process termination and crash telemetry to a centralized logging platform for correlation.
Track file-open events for Wireshark and tshark and correlate against user download and email activity.
Monitor vendor channels for updates to WNPA-SEC-2026-62 and GitLab Work Item #21352.

How to Mitigate CVE-2026-15167

Immediate Actions Required

Upgrade Wireshark to a fixed release above 4.6.6 on the 4.6.x branch or above 4.4.16 on the 4.4.x branch as identified in the vendor advisory.
Instruct analysts not to open DBS Etherwatch capture files received from untrusted or unverified sources until patched.
Isolate automated processing pipelines that ingest third-party capture files with tshark until they run a fixed version.

Patch Information

The Wireshark Foundation has published fixes under advisory WNPA-SEC-2026-62. The upstream fix is tracked in GitLab Work Item #21352. Apply the patched Wireshark builds from the official download channels or through the operating system package manager.

Workarounds

Disable or remove the DBS Etherwatch file format handler in the deployed Wireshark build where feasible.
Restrict Wireshark to analyzing capture files from trusted internal sources only until the upgrade is applied.
Run Wireshark under a least-privilege user account so a crash does not affect other workloads on the host.

bash

# Verify the installed Wireshark version and upgrade to a patched release
wireshark --version
tshark --version

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade wireshark tshark

# RHEL/Fedora
sudo dnf upgrade wireshark wireshark-cli

# macOS (Homebrew)
brew update && brew upgrade --cask wireshark