CVE-2026-5401 Overview
CVE-2026-5401 is a denial of service vulnerability affecting the AFP Spotlight protocol dissector in Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14. The vulnerability is caused by uncontrolled recursion (CWE-674) within the dissector component, which can be triggered when processing malformed or specially crafted network capture files. This can cause the Wireshark application to crash, disrupting network analysis operations.
Critical Impact
An attacker can cause Wireshark to crash by providing a malicious capture file, leading to denial of service for users performing network traffic analysis.
Affected Products
- Wireshark 4.6.0 to 4.6.4
- Wireshark 4.4.0 to 4.4.14
Discovery Timeline
- 2026-04-30 - CVE CVE-2026-5401 published to NVD
- 2026-04-30 - Last updated in NVD database
Technical Details for CVE-2026-5401
Vulnerability Analysis
This vulnerability resides in the AFP (Apple Filing Protocol) Spotlight protocol dissector component of Wireshark. The root issue is uncontrolled recursion that can occur when the dissector processes specially crafted input data. When triggered, the recursive function calls exhaust the available stack space, causing the application to crash.
The vulnerability requires local access and user interaction to exploit—an attacker would need to convince a user to open a malicious capture file or inject malformed AFP Spotlight packets into a live capture session. While the vulnerability does not allow for code execution or data exfiltration, it can effectively disrupt network analysis workflows by crashing the application.
Root Cause
The vulnerability is classified under CWE-674 (Uncontrolled Recursion). The AFP Spotlight dissector fails to properly limit recursive calls when parsing nested data structures within the protocol. When processing maliciously crafted packets with deeply nested or circular references, the dissector enters an uncontrolled recursive loop that eventually exhausts stack resources and causes a crash.
Attack Vector
The attack vector requires local access with user interaction. An attacker can exploit this vulnerability through the following scenarios:
Malicious Capture File: The attacker creates a specially crafted .pcap or .pcapng file containing malformed AFP Spotlight protocol data. When a user opens this file in a vulnerable version of Wireshark, the AFP Spotlight dissector attempts to parse the malicious data, triggering the uncontrolled recursion and causing the application to crash.
Live Capture Injection: In scenarios where an attacker has network access, they could inject malformed AFP Spotlight packets that would be captured and processed by Wireshark in real-time, potentially crashing the application during live analysis.
The exploitation mechanism involves triggering the recursive parsing logic with input that contains structures designed to maximize recursion depth beyond safe limits. For detailed technical information, see the GitLab Issue Report and the Wireshark Security Advisory.
Detection Methods for CVE-2026-5401
Indicators of Compromise
- Unexpected Wireshark application crashes when opening capture files or during live capture sessions
- Crash reports or core dumps indicating stack overflow conditions in the AFP Spotlight dissector module
- System logs showing repeated Wireshark process terminations without user-initiated shutdown
Detection Strategies
- Monitor for abnormal Wireshark process terminations across analyst workstations
- Implement file integrity checking on capture files received from untrusted sources
- Review system event logs for patterns of application crashes associated with wireshark or tshark processes
- Deploy endpoint detection rules to identify suspicious capture file access patterns
Monitoring Recommendations
- Enable application crash reporting and centralized logging for security analyst workstations
- Implement network monitoring to detect potential injection of malformed AFP Spotlight protocol traffic
- Monitor for unusually large or deeply nested capture files that could indicate exploitation attempts
- Review Wireshark version inventory across the organization to identify vulnerable installations
How to Mitigate CVE-2026-5401
Immediate Actions Required
- Upgrade Wireshark to version 4.6.5 or later (for 4.6.x branch) or 4.4.15 or later (for 4.4.x branch)
- Avoid opening capture files from untrusted or unknown sources until patching is complete
- Consider disabling the AFP Spotlight protocol dissector if not required for analysis workflows
- Alert security analysts about the vulnerability and implement temporary operational controls
Patch Information
The Wireshark development team has addressed this vulnerability in subsequent releases. Users should upgrade to the latest stable version available from the official Wireshark website. For detailed patch information and release notes, refer to the Wireshark Security Advisory.
Workarounds
- Disable the AFP Spotlight protocol dissector through Wireshark preferences: Navigate to Analyze > Enabled Protocols and disable AFP Spotlight
- Use command-line filtering with tshark to exclude AFP Spotlight traffic: tshark -r capture.pcap --disable-protocol afpspotlight
- Pre-scan capture files with updated security tools before opening in vulnerable Wireshark versions
- Run Wireshark in an isolated environment or virtual machine when analyzing untrusted capture files
# Disable AFP Spotlight dissector via command line
tshark --disable-protocol afpspotlight -r suspicious_capture.pcap
# Alternative: Edit Wireshark preferences file
echo "afpspotlight.enabled: FALSE" >> ~/.config/wireshark/preferences
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
