CVE-2026-5299 Overview
CVE-2026-5299 is a denial of service vulnerability affecting the ICMPv6 PvD (Provisioning Domains) protocol dissector in Wireshark. The vulnerability allows an attacker to crash the application by supplying a malformed packet that triggers uncontrolled recursion within the dissector, leading to a stack exhaustion condition. This vulnerability is classified under CWE-674 (Uncontrolled Recursion), indicating that the dissector lacks proper depth controls when parsing nested protocol structures.
Critical Impact
Successful exploitation causes Wireshark to crash, disrupting network analysis operations and potentially allowing attackers to evade detection during packet capture sessions.
Affected Products
- Wireshark versions 4.6.0 to 4.6.4
- Wireshark versions 4.4.0 to 4.4.14
Discovery Timeline
- April 30, 2026 - CVE CVE-2026-5299 published to NVD
- April 30, 2026 - Last updated in NVD database
Technical Details for CVE-2026-5299
Vulnerability Analysis
The vulnerability resides in Wireshark's ICMPv6 PvD protocol dissector, which handles Provisioning Domain information transmitted via ICMPv6 Router Advertisement messages. The dissector fails to implement proper recursion depth limits when parsing nested option structures within PvD packets.
When processing a specially crafted ICMPv6 packet containing deeply nested or recursive option fields, the dissector enters an uncontrolled recursive loop. Each recursive call consumes stack memory, and without a termination condition based on depth, the stack becomes exhausted, causing the application to crash.
The attack requires local access in the form of a malicious packet capture file (PCAP) that the user must open, or alternatively, live capture of malicious network traffic on a network segment the attacker can access. User interaction is required to trigger the vulnerability, either by opening a malicious capture file or by capturing traffic containing the malicious packets.
Root Cause
The root cause is CWE-674 (Uncontrolled Recursion) in the ICMPv6 PvD dissector code. The protocol parsing logic recursively processes nested options without maintaining a recursion depth counter or enforcing a maximum depth limit. This allows crafted packets with excessive nesting to exhaust the call stack.
Attack Vector
The attack vector is local, requiring either:
Malicious Capture File: An attacker provides a crafted PCAP file containing the malicious ICMPv6 PvD packet. When the victim opens this file in Wireshark, the dissector crashes.
Live Network Capture: An attacker on the same network segment sends crafted ICMPv6 packets that are captured by a user running Wireshark in live capture mode.
The vulnerability does not compromise confidentiality or integrity but results in complete loss of availability for the Wireshark application during the crash. For detailed technical information, refer to the GitLab Issue Discussion.
Detection Methods for CVE-2026-5299
Indicators of Compromise
- Wireshark processes terminating unexpectedly during packet capture or analysis
- Crash dumps indicating stack overflow conditions in dissector functions
- System logs showing abnormal memory consumption by Wireshark prior to termination
Detection Strategies
- Monitor for Wireshark crash events and analyze core dumps for stack exhaustion patterns
- Implement network monitoring to detect anomalous ICMPv6 Router Advertisement packets with unusual option structures
- Deploy endpoint detection rules that alert on repeated Wireshark application crashes
Monitoring Recommendations
- Enable application crash monitoring for wireshark and tshark processes
- Review packet capture files from untrusted sources in isolated environments before analysis
- Configure SIEM rules to correlate multiple Wireshark crashes that may indicate exploitation attempts
How to Mitigate CVE-2026-5299
Immediate Actions Required
- Upgrade Wireshark to version 4.6.5 or later (for 4.6.x branch) or 4.4.15 or later (for 4.4.x branch)
- Avoid opening packet capture files from untrusted sources until patched
- Disable the ICMPv6 dissector if not required for analysis operations
Patch Information
Wireshark has addressed this vulnerability in updated releases. Security advisories and patch details are available at the Wireshark Security Advisory. Users should update to the latest available version within their release branch.
Workarounds
- Disable the ICMPv6 PvD dissector by adding it to the disabled protocols list via Analyze > Enabled Protocols
- Use command-line filtering with tshark to exclude ICMPv6 traffic when analyzing potentially malicious captures
- Process untrusted capture files in isolated virtual machines to contain potential crashes
# Disable ICMPv6 PvD dissector via preferences file
echo "icmpv6pvd.enabled: FALSE" >> ~/.config/wireshark/preferences
# Alternative: Use tshark with display filter to exclude ICMPv6
tshark -r capture.pcap -Y "!icmpv6"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
