CVE-2026-15170: Wireshark Z39.50 DoS Vulnerability

CVE-2026-15170 Overview

CVE-2026-15170 is a denial of service vulnerability in the Z39.50 protocol dissector shipped with Wireshark. The flaw affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. An attacker who convinces a user to open a crafted capture file, or who injects malicious traffic onto a network being captured, can crash the dissector. The issue is tracked as a heap-based buffer overflow [CWE-122] and is documented in Wireshark Security Advisory WNPA-SEC-2026-58.

Critical Impact
Successful exploitation crashes the Wireshark process, disrupting packet analysis workflows and potentially interrupting active investigations or automated capture pipelines.

Affected Products

Wireshark 4.6.0 through 4.6.6
Wireshark 4.4.0 through 4.4.16
Z39.50 protocol dissector component

Discovery Timeline

2026-07-08 - CVE CVE-2026-15170 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-15170

Vulnerability Analysis

The vulnerability resides in the Z39.50 protocol dissector, a component that parses the ANSI/NISO Z39.50 information retrieval protocol used by library catalog systems. The dissector mishandles boundary conditions when processing malformed protocol fields, producing a heap-based buffer overflow condition classified under [CWE-122]. The result is an application crash that terminates the Wireshark process and any live capture in progress.

The attack surface is local. An adversary must either persuade a user to open a crafted pcap or pcapng file, or inject malicious Z39.50 traffic into a network segment that Wireshark is actively capturing. Confidentiality and integrity are not directly impacted; the effect is limited to availability of the analysis tool. See the GitLab Work Item Analysis for the upstream tracking details.

Root Cause

The root cause is improper validation of length or offset fields inside Z39.50 protocol data units. When the dissector allocates and writes into heap buffers based on attacker-controlled sizes without adequate bounds checks, it corrupts adjacent heap memory. In Wireshark, such corruption reliably triggers a fatal termination through the built-in memory safety abort path.

Attack Vector

Exploitation requires user interaction. The most common path is a socially engineered capture file delivered by email or shared through a collaboration channel. A secondary path is passive: an attacker on a monitored network sends crafted Z39.50 packets that the analyst captures and dissects in real time. Because the flaw is a crash rather than memory disclosure or code execution, its use is limited to disrupting forensic and incident response workflows.

No public proof-of-concept exploit and no evidence of exploitation in the wild have been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-15170

Indicators of Compromise

Unexpected termination of the wireshark or tshark process during dissection of Z39.50 traffic
Presence of capture files containing malformed Z39.50 protocol data units on analyst workstations
Crash reports or core dumps referencing the Z39.50 dissector module

Detection Strategies

Inventory Wireshark installations across analyst workstations and identify hosts running versions in the 4.6.0 to 4.6.6 or 4.4.0 to 4.4.16 ranges.
Alert on repeated crashes of wireshark.exe, tshark, or related dissection processes on the same endpoint within a short window.
Inspect email and file-sharing gateways for .pcap and .pcapng attachments originating from untrusted sources.

Monitoring Recommendations

Enable endpoint telemetry for process termination and crash events on workstations used for packet analysis.
Correlate Wireshark crash events with recent file downloads or capture-file open actions to spot targeted delivery.
Track Wireshark version data through software asset management to confirm remediation coverage over time.

How to Mitigate CVE-2026-15170

Immediate Actions Required

Upgrade Wireshark to a fixed release as listed in Wireshark Security Advisory WNPA-SEC-2026-58.
Restrict opening of untrusted capture files to isolated analysis virtual machines until upgrades complete.
Notify incident response and network engineering teams to avoid loading unverified pcap files on production analyst systems.

Patch Information

The Wireshark Foundation has published fixed builds via the WNPA-SEC-2026-58 advisory. Analysts should install the latest stable release from the vendor and verify the version through wireshark -v or tshark -v after upgrade. The upstream fix is tracked in the GitLab Work Item Analysis.

Workarounds

Disable the Z39.50 dissector through Analyze > Enabled Protocols and clear the Z39.50 checkbox until patching completes.
Use tshark --disable-protocol z3950 when performing batch analysis of untrusted captures.
Avoid opening pcap or pcapng files received from untrusted sources on hosts running vulnerable Wireshark builds.

bash

# Configuration example
# Disable the Z39.50 dissector for a single tshark invocation
tshark --disable-protocol z3950 -r suspicious_capture.pcapng

# Verify installed Wireshark version after upgrade
wireshark -v | head -n 1