CVE-2026-19695 Overview
CVE-2026-19695 is a denial-of-service vulnerability in the Gammu DCT3 trace file parser shipped with Wireshark versions 4.6.0 through 4.6.7. A malformed DCT3 trace file triggers a stack-based buffer overflow [CWE-121] in the dissector, causing the analysis process to crash. The flaw requires local file processing and user interaction, such as opening a crafted capture in Wireshark. Exploitation does not yield code execution or information disclosure based on the published impact metrics, but it disrupts availability of the analysis workflow.
Critical Impact
A crafted Gammu DCT3 trace file crashes Wireshark, interrupting packet analysis sessions and any automated pipelines that rely on the dissector.
Affected Products
- Wireshark 4.6.0
- Wireshark versions 4.6.1 through 4.6.6
- Wireshark 4.6.7
Discovery Timeline
- 2026-08-13 - CVE-2026-19695 published to the National Vulnerability Database
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-19695
Vulnerability Analysis
The defect resides in the Wireshark dissector responsible for parsing Gammu DCT3 trace files. Gammu DCT3 traces capture protocol activity from legacy Nokia DCT3 phones and are commonly loaded during telecom protocol analysis. The parser mishandles fields inside a crafted trace, writing beyond the bounds of a fixed-size stack buffer. The resulting corruption terminates the process, producing a denial of service. The Wireshark security advisory tracks the issue as wnpa-sec-2026-90, and the upstream fix is coordinated through the Wireshark GitLab work item 21475.
Root Cause
The root cause is a stack-based buffer overflow classified under [CWE-121]. The dissector copies attacker-controlled data from a DCT3 trace record into a local buffer without adequately validating the source length against the destination capacity. When the input exceeds the buffer, adjacent stack data is overwritten and the process aborts.
Attack Vector
The attack vector is local and requires user interaction. An attacker delivers a malformed DCT3 trace file to a target analyst through email, shared storage, or malware analysis submission. When the analyst opens the file, or when an automated pipeline invokes tshark against it, the parser overflows the stack buffer and Wireshark crashes. High attack complexity reflects the specific conditions needed to trigger the overflow reliably.
No verified public exploit code is available. See the Wireshark Security Advisory 2026-90 and the GitLab Wireshark Work Item for technical details on the affected parser path.
Detection Methods for CVE-2026-19695
Indicators of Compromise
- Repeated wireshark or tshark process crashes shortly after opening a capture file with DCT3 content.
- Presence of unexpected .dct3 or Gammu trace files delivered through email attachments, chat, or file shares to analysts.
- Crash dumps referencing the DCT3 dissector frame on the call stack.
Detection Strategies
- Alert on abnormal termination of wireshark.exe, tshark.exe, or their Linux and macOS equivalents on analyst workstations.
- Inspect file provenance for DCT3 trace files arriving from untrusted sources before analysts open them.
- Correlate Wireshark process crashes with the file argument passed on the command line to identify weaponized captures.
Monitoring Recommendations
- Track installed Wireshark versions across analyst endpoints and flag any host still running 4.6.0 through 4.6.7.
- Monitor endpoint telemetry for tshark invocations inside automated malware or PCAP analysis pipelines that ingest untrusted files.
- Retain crash artifacts to confirm whether the DCT3 dissector was involved when Wireshark terminates unexpectedly.
How to Mitigate CVE-2026-19695
Immediate Actions Required
- Upgrade Wireshark to the fixed release identified in Wireshark Security Advisory 2026-90.
- Instruct analysts to avoid opening Gammu DCT3 trace files received from untrusted sources until systems are patched.
- Isolate automated capture-processing pipelines that accept externally supplied files and confirm they run a patched Wireshark build.
Patch Information
Refer to Wireshark Security Advisory 2026-90 for the fixed version and to the GitLab Wireshark Work Item for the corresponding upstream patch. Package maintainers for Linux distributions typically publish backported updates shortly after the upstream release.
Workarounds
- Disable the Gammu DCT3 dissector in Wireshark preferences under Analyze > Enabled Protocols on hosts that cannot be patched immediately.
- Restrict analyst workstations from opening trace files supplied by untrusted parties until the update is deployed.
- Run untrusted capture analysis inside disposable virtual machines to contain crashes and any follow-on activity.
# Configuration example: disable the DCT3 dissector from the command line
tshark -o "uat:disabled_protos:\"gsm_a_dtap_dct3\",\"TRUE\"" -r suspicious.dct3
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
