CVE-2026-5406: Wireshark FC-SWILS DoS Vulnerability

CVE-2026-5406 Overview

CVE-2026-5406 is a denial of service vulnerability in Wireshark's FC-SWILS (Fibre Channel Switch Fabric Services) protocol dissector. The vulnerability affects Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14, allowing an attacker to crash the application through a specially crafted packet capture file or network traffic containing malformed FC-SWILS protocol data.

Critical Impact
Attackers can cause Wireshark to crash when analyzing network traffic or packet captures containing malicious FC-SWILS protocol data, disrupting network analysis and forensic operations.

Affected Products

Wireshark 4.6.0 to 4.6.4
Wireshark 4.4.0 to 4.4.14

Discovery Timeline

2026-04-30 - CVE CVE-2026-5406 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-5406

Vulnerability Analysis

This vulnerability is classified under CWE-674 (Uncontrolled Recursion), indicating that the FC-SWILS protocol dissector contains code paths that can lead to uncontrolled recursive function calls. When Wireshark processes specially crafted FC-SWILS protocol data, the dissector fails to properly limit recursion depth, ultimately exhausting the call stack and causing the application to crash.

The local attack vector requires user interaction, meaning an attacker must convince a victim to open a malicious packet capture file or capture traffic containing the malformed protocol data. While this does not allow arbitrary code execution, it effectively renders Wireshark unusable for analyzing the malicious traffic, which could be strategically used to prevent forensic analysis of malicious network activity.

Root Cause

The root cause lies in improper recursion control within the FC-SWILS protocol dissector implementation. The dissector fails to implement adequate bounds checking or recursion depth limits when parsing nested or self-referential protocol structures. This allows an attacker to craft protocol data that triggers excessive recursive calls, eventually exhausting stack memory and causing a crash.

Attack Vector

The attack requires local access and user interaction. An attacker can exploit this vulnerability by:

Creating a malicious packet capture file (.pcap, .pcapng) containing specially crafted FC-SWILS protocol data designed to trigger uncontrolled recursion
Distributing this file to targets through phishing, file sharing, or other social engineering methods
When the victim opens the file in a vulnerable version of Wireshark, the FC-SWILS dissector processes the malformed data and crashes

Alternatively, the vulnerability could be triggered by live capture if the attacker can inject malicious FC-SWILS frames into network traffic being analyzed by the target.

The vulnerability's impact is limited to availability (denial of service) with no direct impact on confidentiality or integrity. For additional technical details, see the GitLab Wireshark Issue and the Wireshark Security Advisory.

Detection Methods for CVE-2026-5406

Indicators of Compromise

Unexpected Wireshark application crashes when opening specific packet capture files
Crash logs indicating stack overflow or recursion-related failures in the FC-SWILS dissector module
Presence of suspicious .pcap or .pcapng files containing FC-SWILS protocol data from untrusted sources

Detection Strategies

Monitor for Wireshark process crashes and analyze crash dumps for FC-SWILS dissector stack traces
Implement file integrity monitoring and scanning for potentially malicious packet capture files
Deploy application crash monitoring to detect patterns of Wireshark failures across the organization

Monitoring Recommendations

Enable application crash reporting and logging for Wireshark installations
Monitor network analysis workstations for unusual crash patterns
Implement centralized logging for security analyst workstations to correlate potential exploitation attempts

How to Mitigate CVE-2026-5406

Immediate Actions Required

Upgrade Wireshark to version 4.6.5 or later for the 4.6.x branch
Upgrade Wireshark to version 4.4.15 or later for the 4.4.x branch
Avoid opening packet capture files from untrusted or unknown sources
Consider disabling the FC-SWILS protocol dissector if not required for analysis workflows

Patch Information

Wireshark has released patched versions addressing this vulnerability. Users should upgrade to the latest stable release available from the official Wireshark website. Details about the security fix can be found in the Wireshark Security Advisory.

Workarounds

Disable the FC-SWILS protocol dissector through Wireshark's protocol preferences if FC-SWILS analysis is not required
Use command-line tools like tshark with specific protocol filters to avoid triggering the vulnerable dissector
Implement sandboxing or isolated environments for analyzing untrusted packet captures

bash

# Disable FC-SWILS dissector via Wireshark preferences
# Navigate to: Edit -> Preferences -> Protocols -> FC-SWILS
# Uncheck "Enable FC-SWILS dissector"

# Alternative: Use tshark with protocol filter to exclude FC-SWILS
tshark -r capture.pcap --disable-protocol fc-swils