CVE-2026-5655: Wireshark SDP Dissector DoS Vulnerability

CVE-2026-5655 Overview

CVE-2026-5655 is a Use After Free vulnerability affecting the SDP (Session Description Protocol) protocol dissector in Wireshark versions 4.6.0 through 4.6.4. This vulnerability allows an attacker to cause a denial of service condition by crafting malicious network traffic or capture files that trigger the vulnerable code path within the SDP dissector component.

Critical Impact
Successful exploitation can crash Wireshark, disrupting network analysis operations and potentially causing loss of unsaved packet captures during forensic investigations.

Affected Products

Wireshark 4.6.0
Wireshark 4.6.1
Wireshark 4.6.2
Wireshark 4.6.3
Wireshark 4.6.4

Discovery Timeline

2026-04-30 - CVE CVE-2026-5655 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-5655

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption vulnerability that occurs when a program continues to use a pointer after the memory it references has been freed. In the context of Wireshark's SDP protocol dissector, this can lead to application crashes when processing specially crafted SDP content within captured network traffic.

The local attack vector requires user interaction, meaning an attacker must convince a victim to open a malicious packet capture file or to capture traffic containing the exploit payload. While this limits the attack surface compared to network-exploitable vulnerabilities, network analysts routinely open capture files from untrusted sources as part of their work, making this a realistic attack scenario.

Root Cause

The root cause lies in improper memory management within the SDP protocol dissector code. When parsing certain SDP message structures, the dissector frees memory and subsequently attempts to access that freed memory region. This Use After Free condition can cause the application to crash when the freed memory is dereferenced, leading to a denial of service.

Attack Vector

The attack requires local access and user interaction. An attacker can exploit this vulnerability through the following methods:

Malicious PCAP Files: Crafting a packet capture file containing SDP traffic with specific characteristics that trigger the Use After Free condition when the file is opened in Wireshark
Live Traffic Capture: Broadcasting malicious SDP packets on a network being monitored by Wireshark, causing the application to crash during live capture
Forensic Investigation Disruption: Targeting security analysts by embedding malicious SDP content within capture files shared for analysis

The vulnerability results in high availability impact, as successful exploitation causes complete application termination. There is no impact on confidentiality or integrity, as the vulnerability does not allow data exfiltration or modification.

Detection Methods for CVE-2026-5655

Indicators of Compromise

Unexpected Wireshark crashes when opening PCAP files containing SDP protocol data
Application crash logs showing faults in the SDP dissector module
Repeated crashes when analyzing specific capture files from untrusted sources

Detection Strategies

Monitor for abnormal Wireshark process terminations, particularly when SDP traffic is being analyzed
Implement file integrity monitoring on capture files before opening them in analysis tools
Use sandboxed environments for initial analysis of untrusted packet captures
Review system logs for crash dump entries related to Wireshark processes

Monitoring Recommendations

Deploy endpoint monitoring to detect repeated application crashes indicative of exploitation attempts
Implement alerting for Wireshark process crashes in security operations environments
Consider using automated PCAP validation tools before manual analysis
Monitor network traffic for anomalous SDP message structures that could indicate exploitation attempts

How to Mitigate CVE-2026-5655

Immediate Actions Required

Upgrade Wireshark to a patched version (4.6.5 or later when available)
Avoid opening untrusted PCAP files in vulnerable Wireshark versions
Use alternative analysis tools for SDP traffic inspection until patching is complete
Implement network segmentation to limit exposure of analyst workstations

Patch Information

Wireshark has released security advisory WNPA-SEC-2026-19 addressing this vulnerability. Users should upgrade to the latest available version that includes the fix for this SDP dissector issue. Additional technical details are available in the GitLab Wireshark Issue tracker.

Workarounds

Disable the SDP protocol dissector if SDP analysis is not required: Navigate to Analyze → Enabled Protocols and disable sdp
Use TShark in a sandboxed or containerized environment for processing untrusted captures
Pre-filter capture files to exclude SDP traffic before opening in Wireshark
Implement strict file provenance controls for packet capture files

bash

# Disable SDP dissector via command line
tshark -o "sdp.enable:false" -r untrusted_capture.pcap

# Alternative: Filter out SDP traffic before analysis
editcap -F pcap input.pcap output.pcap
tshark -r input.pcap -Y "not sdp" -w filtered_output.pcap