CVE-2026-6526: Wireshark RTSP Dissector DoS Vulnerability

CVE-2026-6526 Overview

CVE-2026-6526 is a Null Pointer Dereference vulnerability affecting the RTSP (Real Time Streaming Protocol) dissector in Wireshark versions 4.6.0 through 4.6.4. This vulnerability allows an attacker to cause the application to crash when processing specially crafted RTSP traffic, resulting in a denial of service condition.

The vulnerability is classified as CWE-476 (NULL Pointer Dereference), which occurs when the application attempts to use a pointer that is expected to be valid but is NULL. In the context of Wireshark's protocol dissector, this can be triggered when parsing malformed RTSP packets.

Critical Impact

Processing malicious RTSP traffic can cause Wireshark to crash, disrupting network analysis operations and potentially leading to data loss in active capture sessions.

Affected Products

• Wireshark 4.6.0
• Wireshark 4.6.1
• Wireshark 4.6.2
• Wireshark 4.6.3
• Wireshark 4.6.4

Discovery Timeline

• 2026-04-30 - CVE-2026-6526 published to NVD
• 2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-6526

Vulnerability Analysis

The RTSP protocol dissector in Wireshark contains a null pointer dereference vulnerability that can be exploited when the dissector processes certain malformed RTSP packets. When Wireshark encounters these specially crafted packets during live capture or when opening a capture file, the dissector fails to properly validate pointer references before use, leading to an application crash.

This vulnerability requires user interaction to exploit, as the victim must either capture network traffic containing the malicious packets or open a crafted capture file. The attack vector is local, meaning an attacker would need to deliver the malicious capture file to the target system or have the ability to inject packets on a network segment being monitored by the victim.

The impact is limited to availability (denial of service), with no effect on confidentiality or integrity of the system. However, an unexpected crash during active network analysis could result in loss of captured data and disruption of security monitoring operations.

Root Cause

The vulnerability stems from inadequate null pointer validation in the RTSP dissector code. When parsing RTSP protocol data, the dissector may encounter unexpected or malformed input that results in a NULL pointer being dereferenced. This is a common class of software vulnerability where defensive coding practices such as null checks were not applied before pointer operations.

The issue is tracked under CWE-476 (NULL Pointer Dereference), which is characterized by the application's failure to validate that a pointer is non-null before performing operations on the referenced memory location.

Attack Vector

The attack requires local access and user interaction to exploit. An attacker can deliver a malicious pcap or pcapng capture file containing crafted RTSP traffic to a victim. When the victim opens this file in Wireshark, or if Wireshark captures traffic containing the malicious packets during live analysis, the application crashes.

Attack scenarios include:

• Sending a crafted capture file via email or file sharing with social engineering to convince the target to analyze it
• Injecting malicious RTSP packets on a network segment being monitored by the target analyst
• Hosting a malicious capture file on a website and tricking the victim into downloading and opening it

For additional technical details, refer to the Wireshark Security Advisory WNPA-SEC-2026-35 and the GitLab Wireshark Work Item.

Detection Methods for CVE-2026-6526

Indicators of Compromise

• Unexpected Wireshark application crashes when analyzing RTSP traffic
• Crash dump files showing null pointer exceptions in the RTSP dissector module
• Unusual or malformed RTSP packets in capture files that trigger application instability

Detection Strategies

• Monitor for Wireshark crash events correlated with RTSP protocol analysis
• Implement endpoint detection to alert on repeated Wireshark crashes
• Review capture files for anomalous RTSP packet structures before analysis
• Use application crash monitoring to detect exploitation attempts

Monitoring Recommendations

• Enable crash reporting and logging for Wireshark instances
• Monitor network traffic for malformed RTSP packets that could indicate exploitation attempts
• Review system event logs for Wireshark application faults
• Implement file integrity monitoring on capture file directories

How to Mitigate CVE-2026-6526

Immediate Actions Required

• Update Wireshark to a patched version beyond 4.6.4 when available
• Exercise caution when opening capture files from untrusted sources
• Disable the RTSP dissector if RTSP analysis is not required for your use case
• Run Wireshark in an isolated environment when analyzing untrusted capture files

Patch Information

Wireshark has acknowledged this vulnerability in Security Advisory WNPA-SEC-2026-35. Users should update to the latest available version of Wireshark that addresses this issue. Monitor the official Wireshark website and the GitLab issue tracker for patch availability and additional guidance.

Workarounds

• Disable the RTSP protocol dissector using the Analyze > Enabled Protocols menu option
• Use display or capture filters to exclude RTSP traffic when not needed
• Analyze untrusted capture files in isolated virtual machines
• Consider using alternative packet analysis tools for RTSP traffic until a patch is applied

# Disable RTSP dissector via Wireshark preferences
# Edit ~/.config/wireshark/disabled_protos with:
rtsp

# Alternatively, use a capture filter to exclude RTSP traffic
# when capturing on networks with potentially malicious traffic:
wireshark -f "not port 554"