CVE-2026-5653: Wireshark DCP-ETSI DoS Vulnerability

CVE-2026-5653 Overview

CVE-2026-5653 is a Denial of Service vulnerability affecting Wireshark's DCP-ETSI protocol dissector. The vulnerability exists in Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14, where a heap-based buffer overflow (CWE-122) in the DCP-ETSI dissector can cause the application to crash when processing specially crafted network traffic or capture files.

Critical Impact
Attackers can cause Wireshark to crash by sending or inducing analysis of malicious DCP-ETSI protocol data, disrupting network analysis operations and potentially enabling further attacks during the outage period.

Affected Products

Wireshark 4.6.0 to 4.6.4
Wireshark 4.4.0 to 4.4.14

Discovery Timeline

2026-04-30 - CVE-2026-5653 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-5653

Vulnerability Analysis

This vulnerability stems from a heap-based buffer overflow (CWE-122) in the DCP-ETSI protocol dissector component of Wireshark. The DCP-ETSI (Digital Content Protection - ETSI) protocol is used in digital broadcasting systems, and Wireshark includes a dissector to decode and analyze this protocol traffic.

The flaw allows an attacker to craft malicious network packets or capture files that, when processed by Wireshark's DCP-ETSI dissector, trigger a heap buffer overflow condition. This memory corruption leads to an application crash, resulting in denial of service.

The attack requires local access and user interaction—specifically, a victim must open a malicious capture file or capture traffic containing the exploit payload. While this limits the attack surface compared to remotely exploitable vulnerabilities, it remains a significant concern for security analysts and network administrators who routinely analyze untrusted network captures.

Root Cause

The root cause is a heap-based buffer overflow (CWE-122) within the DCP-ETSI protocol dissector. The dissector fails to properly validate buffer boundaries when parsing certain protocol fields, allowing specially crafted input to write beyond allocated heap memory. This memory corruption destabilizes the application and causes an immediate crash.

Attack Vector

The attack vector is local with required user interaction. An attacker must deliver a malicious packet capture file (.pcap, .pcapng) to the victim or position themselves to inject malicious DCP-ETSI packets into network traffic being monitored by the target Wireshark instance.

Attack scenarios include:

Sending a malicious capture file via email or file sharing to a network analyst
Placing a malicious capture file on a shared network drive accessed by security teams
Injecting crafted DCP-ETSI packets into a network segment being monitored by the victim

The vulnerability manifests when Wireshark's DCP-ETSI dissector processes malformed protocol data, triggering the heap buffer overflow and causing an application crash. For detailed technical information, see the Wireshark Security Advisory WNPA-SEC-2026-22 and GitLab Issue #21122.

Detection Methods for CVE-2026-5653

Indicators of Compromise

Unexpected Wireshark application crashes or terminations during packet analysis
Crash dump files indicating heap corruption in DCP-ETSI dissector modules
Presence of suspicious .pcap or .pcapng files containing DCP-ETSI protocol traffic from untrusted sources

Detection Strategies

Monitor for abnormal Wireshark process terminations, particularly during automated capture analysis workflows
Implement file inspection for capture files containing DCP-ETSI protocol data before opening in vulnerable Wireshark versions
Deploy endpoint detection to identify crash patterns consistent with heap overflow exploitation in Wireshark

Monitoring Recommendations

Enable application crash reporting and centralize logs from systems running Wireshark
Monitor file access patterns for .pcap and .pcapng files from external or untrusted sources
Track Wireshark version inventory across the organization to identify vulnerable installations

How to Mitigate CVE-2026-5653

Immediate Actions Required

Update Wireshark to versions 4.6.5 or later (for 4.6.x branch) or 4.4.15 or later (for 4.4.x branch)
Avoid opening capture files from untrusted or unknown sources until patching is complete
Consider disabling the DCP-ETSI protocol dissector if not required for operational needs

Patch Information

The Wireshark development team has addressed this vulnerability in updated releases. Organizations should consult the Wireshark Security Advisory WNPA-SEC-2026-22 for official patch information and download updated versions from the official Wireshark website. Additional technical details are available in GitLab Issue #21122.

Workarounds

Disable the DCP-ETSI protocol dissector via Wireshark's protocol preferences: Analyze → Enabled Protocols → uncheck DCP-ETSI
Use command-line option to disable the dissector: wireshark --disable-protocol dcp-etsi
Implement network isolation for systems running Wireshark to prevent exposure to malicious traffic
Validate capture files using automated scanning before manual analysis on vulnerable systems

bash

# Disable DCP-ETSI dissector via command line
wireshark --disable-protocol dcp-etsi

# Alternative: Run tshark with dissector disabled for automated processing
tshark --disable-protocol dcp-etsi -r capture.pcapng