CVE-2026-15169: Wireshark UMTS FP DoS Vulnerability

CVE-2026-15169 Overview

CVE-2026-15169 is a denial of service vulnerability in the Universal Mobile Telecommunications System Frame Protocol (UMTS FP) dissector shipped with Wireshark. The flaw affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. A crafted packet capture or live traffic containing malformed UMTS FP frames causes the dissector to crash, terminating the Wireshark process. The issue is tracked under [CWE-122: Heap-based Buffer Overflow]. Exploitation requires local user interaction, typically opening a malicious capture file. No confidentiality or integrity impact is present, but availability is fully affected within the analyst workflow.

Critical Impact
A malformed UMTS FP packet processed by Wireshark triggers a heap-based memory corruption in the dissector, causing the application to crash and interrupting network analysis workflows.

Affected Products

Wireshark 4.6.0 through 4.6.6
Wireshark 4.4.0 through 4.4.16
UMTS FP protocol dissector component

Discovery Timeline

2026-07-08 - CVE-2026-15169 published to the National Vulnerability Database
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-15169

Vulnerability Analysis

The vulnerability resides in the UMTS Frame Protocol dissector, a component Wireshark uses to parse Iub and Iur interface traffic in 3G mobile networks. The dissector mishandles a memory region on the heap while processing UMTS FP frames. When a specially crafted frame is parsed, the dissector writes or reads outside the allocated heap buffer, corrupting adjacent memory and causing Wireshark to terminate.

The impact is limited to denial of service against the analyst environment. Wireshark typically runs with the privileges of the invoking user, and this specific defect does not produce arbitrary code execution based on the available advisory data. Analysts lose in-progress captures and dissection state when the process aborts.

The attack path is local and requires user interaction, matching the CVSS vector AV:L/AC:L/PR:N/UI:R. A user must open a malicious capture file, load a hostile packet from a shared source, or listen to a live interface receiving crafted traffic.

Root Cause

The root cause is improper bounds checking within the UMTS FP dissector when handling field lengths or offsets in a malformed frame. This aligns with [CWE-122] heap buffer overflow behavior in protocol parsers, where attacker-controlled length values drive memory operations without adequate validation.

Attack Vector

An attacker delivers a crafted pcap or pcapng file to a target analyst, or transmits crafted UMTS FP traffic on a network segment the analyst is capturing. When Wireshark or tshark dissects the frame, the process crashes. Details are available in the Wireshark Security Advisory WNPA-SEC-2026-59 and the corresponding GitLab Work Item Report.

No verified public exploit code is available. The vulnerability mechanism involves the UMTS FP dissector reading attacker-controlled fields from the input frame and using those values in heap memory operations without sufficient validation.

Detection Methods for CVE-2026-15169

Indicators of Compromise

Unexpected termination of wireshark or tshark processes shortly after loading a capture file or beginning a live capture
Crash reports or core dumps referencing the packet-umts_fp.c dissector module
Inbound capture files from untrusted sources containing UMTS FP frames with anomalous length fields

Detection Strategies

Monitor endpoint telemetry for wireshark.exe, wireshark, or tshark process crashes on analyst workstations
Inspect capture files with capinfos and editcap prior to opening in a full GUI session to identify unusual protocol distributions
Correlate crash events with recent file downloads or email attachments containing .pcap or .pcapng files

Monitoring Recommendations

Track Wireshark and tshark version inventory across analyst workstations and forensic virtual machines
Alert on crash telemetry originating from packet analysis tooling on hosts that handle third-party capture files
Log capture file provenance in incident response workflows to support post-incident triage

How to Mitigate CVE-2026-15169

Immediate Actions Required

Upgrade Wireshark to a fixed release above 4.6.6 in the 4.6.x branch or above 4.4.16 in the 4.4.x branch as published by the Wireshark Foundation
Restrict opening of untrusted capture files to isolated analysis virtual machines
Communicate the advisory to threat hunting and network forensics teams that routinely handle external pcap samples

Patch Information

Apply the vendor-supplied update referenced in Wireshark Security Advisory WNPA-SEC-2026-59. The advisory identifies the fixed versions and links to the corresponding source changes tracked in the GitLab Work Item Report.

Workarounds

Disable the UMTS FP dissector through Analyze > Enabled Protocols in the Wireshark GUI when parsing untrusted captures
Use tshark --disable-protocol umts_fp when performing batch dissection of external capture files
Process untrusted captures inside a disposable sandbox or container to contain any dissector crash

bash

# Configuration example: disable the vulnerable dissector for batch processing
tshark --disable-protocol umts_fp -r suspicious_capture.pcapng -V