CVE-2026-5404: Wireshark DOS Vulnerability

CVE-2026-5404 Overview

CVE-2026-5404 is a denial of service vulnerability in the Wireshark K12 RF5 file parser. The flaw affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. An attacker can trigger a parser crash by convincing a user to open a malformed K12 RF5 capture file in Wireshark or TShark. The vulnerability is classified under CWE-120 (Buffer Copy without Checking Size of Input).

Critical Impact
A crafted K12 RF5 capture file causes Wireshark to crash, disrupting packet analysis workflows and potentially interrupting active investigations.

Affected Products

Wireshark 4.6.0 through 4.6.4
Wireshark 4.4.0 through 4.4.14
Wireshark distributions bundling the affected K12 RF5 file parser

Discovery Timeline

2026-05-01 - CVE-2026-5404 published to NVD
2026-05-01 - Last updated in NVD database
2026-05-07 - EPSS data published (probability 0.011%, percentile 1.276)

Technical Details for CVE-2026-5404

Vulnerability Analysis

The vulnerability resides in the K12 RF5 capture file parser shipped with Wireshark. The parser fails to enforce proper boundary checks when copying data from a crafted RF5 file into internal buffers. Processing a malicious file produces a crash, terminating the Wireshark or TShark process.

The issue requires user interaction. A victim must open or load the malicious capture file inside an affected Wireshark build. The attacker does not need credentials or network access to the target host. Exploitation does not yield code execution, information disclosure, or integrity loss according to the CVSS vector. The impact is limited to availability of the analyzer.

Root Cause

The parser performs an unchecked copy operation on attacker-controlled length fields embedded in the K12 RF5 file format, consistent with CWE-120. Malformed records cause the parser to read or write outside allocated buffer bounds, producing a fatal crash. Refer to the Wireshark Security Advisory WNPA-2026-15 and the GitLab Wireshark Issue #21094 for the upstream technical analysis.

Attack Vector

Delivery requires social engineering. An attacker emails, uploads, or otherwise distributes a crafted .rf5 capture file to an analyst. Opening the file in an affected version of Wireshark or TShark triggers the crash. Shared analysis platforms that auto-load capture files in Wireshark are equally exposed.

No proof-of-concept exploit is publicly available. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and EPSS scoring places exploitation probability at 0.011%.

Detection Methods for CVE-2026-5404

Indicators of Compromise

Unexpected termination of wireshark.exe, tshark.exe, or the equivalent Linux or macOS binaries when opening capture files
Crash dumps or Windows Error Reporting events tied to Wireshark processes that were processing K12 RF5 files
Inbound capture files with .rf5 extensions originating from untrusted email senders or file-sharing links

Detection Strategies

Monitor endpoints running Wireshark for abnormal process exits and correlate with recent file-open events
Inspect mail and web gateway logs for .rf5 attachments delivered to security analysts and incident responders
Track Wireshark version inventory using software asset management tools to flag hosts still on vulnerable releases

Monitoring Recommendations

Alert on Wireshark or TShark process crashes generated outside of expected debugging activity
Audit shared capture-file repositories for files added by external or unverified contributors
Maintain telemetry on analyst workstations because the local attack vector limits visibility to endpoint sources

How to Mitigate CVE-2026-5404

Immediate Actions Required

Upgrade Wireshark to a fixed release as documented in WNPA-2026-15
Avoid opening K12 RF5 capture files received from untrusted sources until the upgrade is complete
Inventory all systems running Wireshark 4.6.0–4.6.4 or 4.4.0–4.4.14 and prioritize patching

Patch Information

The Wireshark Foundation has published a security advisory and a corresponding fix tracked in GitLab Issue #21094. Apply the vendor-supplied update for the 4.6 or 4.4 branch. Users on long-term support distributions should pull the backported package from their distribution repository once available.

Workarounds

Disable or remove the K12 RF5 file format dissector in the Wireshark preferences if patching is delayed
Restrict capture-file processing to dedicated analysis hosts isolated from production networks
Use command-line tools that do not invoke the K12 RF5 parser when triaging untrusted files

bash

# Verify installed Wireshark version on Linux
wireshark --version | head -n 1

# Disable the K12 dissector at runtime via TShark
tshark -o 'disabled_protos:k12' -r suspect.rf5