CVE-2026-19694 Overview
CVE-2026-19694 is a denial-of-service vulnerability in the Wireshark TTX Logger file parser. The flaw affects Wireshark versions 4.6.0 through 4.6.7 and is classified under [CWE-122] Heap-based Buffer Overflow. An attacker can trigger a crash by convincing a local user to open a crafted TTX Logger capture file in Wireshark.
The issue does not permit code execution or information disclosure. Exploitation requires local access and user interaction, and it results in loss of availability for the analyst workstation running the vulnerable parser.
Critical Impact
A crafted TTX Logger capture file causes Wireshark to crash, disrupting network analysis workflows on the affected host.
Affected Products
- Wireshark 4.6.0
- Wireshark 4.6.1 through 4.6.6
- Wireshark 4.6.7
Discovery Timeline
- 2026-08-13 - CVE-2026-19694 published to NVD
- 2026-08-13 - Last updated in NVD database
- Referenced in Wireshark Security Advisory WNPA-SEC-2026-68 and GitLab Work Item #21389
Technical Details for CVE-2026-19694
Vulnerability Analysis
The vulnerability resides in the TTX Logger file parser within Wireshark. When the parser processes a malformed capture file, it performs a memory operation that corrupts heap state, leading to a process crash. The defect is tracked as a heap-based buffer overflow ([CWE-122]).
Exploitation causes Wireshark to terminate abnormally. The attack does not expose memory contents to the attacker and does not yield code execution based on the impact metrics associated with this CVE.
Root Cause
The root cause is improper bounds validation while parsing TTX Logger records. The parser trusts length or structure fields inside the input file and writes past the boundaries of a heap-allocated buffer. See the GitLab Work Item #21389 for the upstream tracker.
Attack Vector
An attacker must deliver a crafted TTX Logger file to a target user. The user must open the file, or configure Wireshark to open it, on a system running an affected release. Successful triggering crashes the Wireshark process without producing persistent artifacts.
No public exploit or in-the-wild abuse has been reported for this CVE. Delivery typically occurs via email attachment, shared network storage, or capture files provided during triage.
Detection Methods for CVE-2026-19694
Indicators of Compromise
- Unexpected Wireshark process termination immediately after opening a TTX Logger capture file.
- Presence of untrusted .ttx or TTX Logger capture files in analyst working directories or email attachments.
- Application crash reports referencing Wireshark modules involved in file parsing.
Detection Strategies
- Inventory endpoints running Wireshark and identify installations in the 4.6.0 through 4.6.7 range.
- Alert on repeated Wireshark process crashes on analyst workstations, which may indicate parser abuse.
- Inspect email and file-sharing telemetry for capture files delivered from untrusted external senders.
Monitoring Recommendations
- Collect application crash telemetry from analyst hosts and correlate with recent file open events.
- Track software inventory to confirm Wireshark builds match a patched release once available.
- Review Wireshark advisories at wireshark.org/security for supersedent fixes.
How to Mitigate CVE-2026-19694
Immediate Actions Required
- Upgrade Wireshark to a version outside the affected range once the vendor publishes a fixed release.
- Instruct analysts to avoid opening TTX Logger capture files received from untrusted or unverified sources.
- Isolate analysis of untrusted capture files to a dedicated, non-production workstation.
Patch Information
Refer to Wireshark Security Advisory WNPA-SEC-2026-68 and the associated GitLab Work Item #21389 for the authoritative fix version and patch details. Apply the vendor-provided update to all affected installations.
Workarounds
- Disable or avoid the TTX Logger file parser workflow until the patch is deployed.
- Restrict Wireshark usage on production or sensitive systems to reduce exposure to malicious capture files.
- Validate the origin and integrity of capture files before opening them in an affected Wireshark build.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
