CVE-2026-6524: Wireshark MySQL Dissector DoS Vulnerability

CVE-2026-6524 Overview

CVE-2026-6524 is a denial of service vulnerability in Wireshark's MySQL protocol dissector. The vulnerability affects Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14, allowing attackers to crash the application through specially crafted network traffic or capture files. This vulnerability is classified as CWE-824 (Access of Uninitialized Pointer), indicating the dissector accesses memory through an uninitialized pointer, leading to application instability.

Critical Impact

An attacker can cause Wireshark to crash by sending malformed MySQL protocol packets or by tricking a user into opening a malicious capture file, disrupting network analysis operations.

Affected Products

• Wireshark 4.6.0 to 4.6.4
• Wireshark 4.4.0 to 4.4.14

Discovery Timeline

• 2026-04-30 - CVE CVE-2026-6524 published to NVD
• 2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-6524

Vulnerability Analysis

The vulnerability resides in the MySQL protocol dissector component of Wireshark. Protocol dissectors are responsible for parsing and displaying network protocol data in a human-readable format. The MySQL dissector processes MySQL protocol traffic to help network administrators and security analysts understand database communications.

The root cause is an access of uninitialized pointer (CWE-824) within the dissector logic. When the MySQL dissector processes certain malformed or unexpected packet structures, it attempts to dereference a pointer that has not been properly initialized. This leads to unpredictable behavior, typically resulting in a crash of the Wireshark application.

The local attack vector requires user interaction, as the victim must either open a malicious capture file (.pcap, .pcapng) or capture live traffic containing the malformed MySQL packets. While this limits the attack surface compared to remote vulnerabilities, it remains a significant concern in environments where analysts regularly examine untrusted packet captures.

Root Cause

The vulnerability stems from improper initialization of a pointer variable in the MySQL protocol dissector before it is accessed. When processing certain MySQL protocol packets, the dissector code path may bypass pointer initialization while still attempting to use the pointer value later in the execution flow. This uninitialized memory access causes undefined behavior, resulting in application crashes.

Attack Vector

The attack requires local access and user interaction. An attacker can exploit this vulnerability through two primary methods:

1. Malicious Capture File: Crafting a packet capture file containing specially formed MySQL protocol packets that trigger the uninitialized pointer access when opened in Wireshark
2. Live Traffic Injection: Injecting malformed MySQL protocol packets into network traffic being monitored by a Wireshark instance

When Wireshark attempts to dissect the malicious packets, the MySQL protocol dissector encounters the vulnerability condition and crashes, causing denial of service. This can disrupt forensic investigations, network troubleshooting, or security monitoring activities.

For technical details on the specific packet structures that trigger this vulnerability, refer to the GitLab Work Item #21172 and the Wireshark Security Advisory WNPA-SEC-2026-37.

Detection Methods for CVE-2026-6524

Indicators of Compromise

• Wireshark application crashes when opening specific capture files or analyzing MySQL traffic
• Crash logs or core dumps indicating failure in the MySQL dissector component
• Unexpected termination of Wireshark during packet analysis sessions involving MySQL protocol data

Detection Strategies

• Monitor for repeated Wireshark process crashes in security analysis workstations
• Implement file integrity monitoring on capture files before analysis
• Review system logs for crash reports associated with Wireshark processes
• Use sandboxed environments for analyzing untrusted packet captures

Monitoring Recommendations

• Track Wireshark version inventory across analysis workstations to identify vulnerable installations
• Enable crash reporting and centralize logs from security analysis systems
• Monitor for anomalous MySQL protocol traffic patterns in network captures

How to Mitigate CVE-2026-6524

Immediate Actions Required

• Upgrade Wireshark to version 4.6.5 or later (for 4.6.x branch)
• Upgrade Wireshark to version 4.4.15 or later (for 4.4.x branch)
• Avoid opening capture files from untrusted sources until patched
• Disable the MySQL dissector if MySQL protocol analysis is not required

Patch Information

Wireshark has addressed this vulnerability in their latest security releases. Users should upgrade to the patched versions as soon as possible. Detailed information is available in the Wireshark Security Advisory WNPA-SEC-2026-37.

Workarounds

• Disable the MySQL dissector by navigating to Analyze → Enabled Protocols and unchecking MySQL
• Use command-line tools like tshark with the -d option to skip MySQL dissection
• Analyze untrusted captures in isolated virtual machines or sandboxed environments
• Use display filters to exclude MySQL traffic from analysis when the protocol is not relevant

# Disable MySQL dissector via command line
tshark -r capture.pcap --disable-protocol mysql

# Alternative: Use editcap to filter out MySQL traffic before analysis
editcap -r input.pcap output.pcap "not port 3306"