CVE-2026-19696 Overview
CVE-2026-19696 affects the Ixia IxVeriWave and Vector Informatik Binary Logging Format (BLF) file parsers in Wireshark versions 4.6.0 through 4.6.7 on Windows. A crafted capture file triggers an out-of-bounds write [CWE-787], causing the parser to crash. The flaw enables a local denial-of-service condition when a user opens or processes a malicious file. The Wireshark project addressed the issue in advisory WNPA-SEC-2026-82.
Critical Impact
Opening a malicious IxVeriWave or BLF capture file crashes Wireshark, disrupting protocol analysis workflows on affected Windows hosts.
Affected Products
- Wireshark 4.6.0 through 4.6.7 on Windows
- Ixia IxVeriWave file parser component
- Vector Informatik BLF file parser component
Discovery Timeline
- 2026-08-13 - CVE-2026-19696 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-19696
Vulnerability Analysis
The vulnerability resides in the Wireshark file parsers responsible for reading Ixia IxVeriWave capture files and Vector Informatik Binary Logging Format (BLF) files. When Wireshark processes a specially crafted file, the parser writes data outside the bounds of an allocated buffer. The out-of-bounds write [CWE-787] corrupts adjacent memory and terminates the application process.
Exploitation requires user interaction. An analyst must open the malicious capture or load it into a live analysis session. On Windows systems, the crash results in loss of the current analysis state and any unsaved work within the Wireshark session.
The issue is scoped to a denial-of-service outcome rather than code execution based on the observed availability impact. Consult the Wireshark Security Advisory WNPA-SEC-2026-82 and GitLab Work Item 21455 for upstream analysis.
Root Cause
The root cause is improper bounds checking within the IxVeriWave and BLF dissectors when parsing untrusted file structures. Malformed length or offset fields drive the parser to write past allocated memory regions. This class of defect is characteristic of file-format parsers that trust attacker-controlled size metadata.
Attack Vector
The attack vector is local and requires user interaction. An attacker delivers a crafted .wrq, .vwr, or .blf file through email, shared storage, or download links. When a user opens the file in Wireshark on Windows, the parser triggers the out-of-bounds write and the process crashes.
No authentication or elevated privileges are needed. The exploitation path relies entirely on convincing an analyst to open the malicious capture.
Detection Methods for CVE-2026-19696
Indicators of Compromise
- Unexpected Wireshark process crashes on Windows endpoints immediately after opening capture files
- Windows Error Reporting (WER) entries referencing wireshark.exe with faulting modules tied to file parsing
- Presence of unsolicited .vwr (IxVeriWave) or .blf (Vector BLF) files in user download or mail directories
Detection Strategies
- Monitor endpoint telemetry for abnormal termination of wireshark.exe and tshark.exe correlated with recent file-open events
- Alert on delivery of BLF or IxVeriWave capture files from external sources to workstations used by network engineering teams
- Inventory installed Wireshark versions across the environment and flag hosts running 4.6.0 through 4.6.7
Monitoring Recommendations
- Track WER and application crash logs on hosts where Wireshark is installed
- Correlate file download and email attachment events with subsequent Wireshark process activity
- Baseline analyst workstations for Wireshark version compliance and generate drift alerts
How to Mitigate CVE-2026-19696
Immediate Actions Required
- Upgrade Wireshark to a version outside the 4.6.0 through 4.6.7 range that includes the WNPA-SEC-2026-82 fix
- Instruct analysts to avoid opening IxVeriWave or BLF capture files received from untrusted sources
- Restrict Wireshark installations to workstations that require protocol analysis
Patch Information
Apply the Wireshark update referenced in Wireshark Security Advisory WNPA-SEC-2026-82. Track the upstream fix in GitLab Work Item 21455. Deploy the patched version through standard software distribution channels and verify version compliance after rollout.
Workarounds
- Disable the IxVeriWave and Vector BLF dissectors in Wireshark preferences until patching is complete
- Open unknown capture files only within isolated virtual machines that can be reverted after analysis
- Validate the source and integrity of capture files before loading them into production analyst environments
# Verify installed Wireshark version on Windows
"C:\Program Files\Wireshark\wireshark.exe" --version
# Query installed version via PowerShell across managed endpoints
Get-CimInstance Win32_Product | Where-Object { $_.Name -like 'Wireshark*' } | Select-Object Name, Version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
