CVE-2026-6526: Wireshark RTSP Dissector DoS Vulnerability

CVE-2026-6526 Overview

CVE-2026-6526 is a Null Pointer Dereference vulnerability affecting the RTSP (Real Time Streaming Protocol) dissector in Wireshark versions 4.6.0 through 4.6.4. This vulnerability allows an attacker to cause the application to crash when processing specially crafted RTSP traffic, resulting in a denial of service condition.

The vulnerability is classified as CWE-476 (NULL Pointer Dereference), which occurs when the application attempts to use a pointer that is expected to be valid but is NULL. In the context of Wireshark's protocol dissector, this can be triggered when parsing malformed RTSP packets.

Critical Impact
Processing malicious RTSP traffic can cause Wireshark to crash, disrupting network analysis operations and potentially leading to data loss in active capture sessions.

Affected Products

Wireshark 4.6.0
Wireshark 4.6.1
Wireshark 4.6.2
Wireshark 4.6.3
Wireshark 4.6.4

Discovery Timeline

2026-04-30 - CVE-2026-6526 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-6526

Vulnerability Analysis

The RTSP protocol dissector in Wireshark contains a null pointer dereference vulnerability that can be exploited when the dissector processes certain malformed RTSP packets. When Wireshark encounters these specially crafted packets during live capture or when opening a capture file, the dissector fails to properly validate pointer references before use, leading to an application crash.

This vulnerability requires user interaction to exploit, as the victim must either capture network traffic containing the malicious packets or open a crafted capture file. The attack vector is local, meaning an attacker would need to deliver the malicious capture file to the target system or have the ability to inject packets on a network segment being monitored by the victim.

The impact is limited to availability (denial of service), with no effect on confidentiality or integrity of the system. However, an unexpected crash during active network analysis could result in loss of captured data and disruption of security monitoring operations.

Root Cause

The vulnerability stems from inadequate null pointer validation in the RTSP dissector code. When parsing RTSP protocol data, the dissector may encounter unexpected or malformed input that results in a NULL pointer being dereferenced. This is a common class of software vulnerability where defensive coding practices such as null checks were not applied before pointer operations.

The issue is tracked under CWE-476 (NULL Pointer Dereference), which is characterized by the application's failure to validate that a pointer is non-null before performing operations on the referenced memory location.

Attack Vector

The attack requires local access and user interaction to exploit. An attacker can deliver a malicious pcap or pcapng capture file containing crafted RTSP traffic to a victim. When the victim opens this file in Wireshark, or if Wireshark captures traffic containing the malicious packets during live analysis, the application crashes.

Attack scenarios include:

Sending a crafted capture file via email or file sharing with social engineering to convince the target to analyze it
Injecting malicious RTSP packets on a network segment being monitored by the target analyst
Hosting a malicious capture file on a website and tricking the victim into downloading and opening it

For additional technical details, refer to the Wireshark Security Advisory WNPA-SEC-2026-35 and the GitLab Wireshark Work Item.

Detection Methods for CVE-2026-6526

Indicators of Compromise

Unexpected Wireshark application crashes when analyzing RTSP traffic
Crash dump files showing null pointer exceptions in the RTSP dissector module
Unusual or malformed RTSP packets in capture files that trigger application instability

Detection Strategies

Monitor for Wireshark crash events correlated with RTSP protocol analysis
Implement endpoint detection to alert on repeated Wireshark crashes
Review capture files for anomalous RTSP packet structures before analysis
Use application crash monitoring to detect exploitation attempts

Monitoring Recommendations

Enable crash reporting and logging for Wireshark instances
Monitor network traffic for malformed RTSP packets that could indicate exploitation attempts
Review system event logs for Wireshark application faults
Implement file integrity monitoring on capture file directories

How to Mitigate CVE-2026-6526

Immediate Actions Required

Update Wireshark to a patched version beyond 4.6.4 when available
Exercise caution when opening capture files from untrusted sources
Disable the RTSP dissector if RTSP analysis is not required for your use case
Run Wireshark in an isolated environment when analyzing untrusted capture files

Patch Information

Wireshark has acknowledged this vulnerability in Security Advisory WNPA-SEC-2026-35. Users should update to the latest available version of Wireshark that addresses this issue. Monitor the official Wireshark website and the GitLab issue tracker for patch availability and additional guidance.

Workarounds

Disable the RTSP protocol dissector using the Analyze > Enabled Protocols menu option
Use display or capture filters to exclude RTSP traffic when not needed
Analyze untrusted capture files in isolated virtual machines
Consider using alternative packet analysis tools for RTSP traffic until a patch is applied

bash

# Disable RTSP dissector via Wireshark preferences
# Edit ~/.config/wireshark/disabled_protos with:
rtsp

# Alternatively, use a capture filter to exclude RTSP traffic
# when capturing on networks with potentially malicious traffic:
wireshark -f "not port 554"