CVE-2026-6532: Wireshark Kismet DoS Vulnerability

CVE-2026-6532 Overview

CVE-2026-6532 is a denial of service vulnerability affecting the Kismet protocol dissector in Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. The vulnerability allows an attacker to crash Wireshark by providing a specially crafted packet capture file or network traffic containing malformed Kismet protocol data, causing the application to terminate unexpectedly.

Critical Impact
Users analyzing network traffic with affected Wireshark versions may experience application crashes when processing malicious Kismet protocol data, disrupting network analysis operations and potentially causing loss of captured data.

Affected Products

Wireshark 4.6.0 to 4.6.4
Wireshark 4.4.0 to 4.4.14

Discovery Timeline

2026-04-30 - CVE-2026-6532 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-6532

Vulnerability Analysis

This vulnerability is classified under CWE-126 (Buffer Over-read), indicating that the Kismet protocol dissector reads data beyond the boundaries of an allocated buffer. When processing Kismet protocol packets, the dissector fails to properly validate input length before attempting to read protocol fields, leading to an out-of-bounds read condition.

The vulnerability requires local access, meaning an attacker must either provide a malicious capture file to the victim or be in a position to inject crafted packets into network traffic being monitored by Wireshark. While the attack requires user interaction (opening a capture file or capturing specific traffic), no special privileges are needed to exploit this vulnerability.

The impact is limited to availability—the vulnerability does not allow for information disclosure or integrity violations. However, in environments where continuous network monitoring is critical, such crashes can create significant operational disruptions.

Root Cause

The root cause lies in improper bounds checking within the Kismet protocol dissector code. When parsing Kismet protocol frames, the dissector attempts to read field data without first verifying that sufficient bytes remain in the packet buffer. This results in a buffer over-read condition (CWE-126) when processing truncated or maliciously crafted packets, causing the application to crash.

Attack Vector

The attack vector requires local interaction with the target system. An attacker can exploit this vulnerability through several methods:

Malicious Capture File: Craft a .pcap or .pcapng file containing malformed Kismet protocol packets and distribute it to victims via email, file sharing, or other means.
Network Injection: If the attacker is on the same network segment being monitored, they can inject specially crafted Kismet protocol packets that will trigger the crash when Wireshark processes them.
Man-in-the-Middle: An attacker positioned between a Kismet server and client could inject malformed packets to crash Wireshark instances monitoring that traffic.

The vulnerability mechanism involves the Kismet dissector attempting to parse protocol fields without adequate length validation. When the dissector encounters a malformed packet with insufficient data, it reads past the allocated buffer boundary, triggering a crash. For detailed technical information, refer to the GitLab Wireshark Issue #21128 and Issue #21129.

Detection Methods for CVE-2026-6532

Indicators of Compromise

Unexpected Wireshark application crashes or termination during packet analysis
Crash logs referencing the Kismet protocol dissector or related functions
Core dumps or error reports generated when processing specific capture files
Repeated application restarts when capturing traffic from networks with Kismet devices

Detection Strategies

Monitor system event logs for frequent Wireshark crash events
Implement file integrity monitoring on capture files received from external sources
Deploy endpoint detection solutions to identify anomalous application termination patterns
Use sandboxed environments when analyzing capture files from untrusted sources

Monitoring Recommendations

Configure crash reporting to alert security teams of repeated Wireshark failures
Monitor for unusual patterns of capture file distribution via email or file shares
Track Wireshark version deployments across the organization to identify vulnerable installations
Review network traffic for unexpected Kismet protocol activity in environments where Kismet is not deployed

How to Mitigate CVE-2026-6532

Immediate Actions Required

Update Wireshark to version 4.6.5 or later (for 4.6.x branch) or 4.4.15 or later (for 4.4.x branch)
Avoid opening capture files from untrusted sources until patched
Consider disabling the Kismet protocol dissector if not required for your analysis workflows
Use alternative packet analysis tools for processing untrusted capture files

Patch Information

Wireshark has addressed this vulnerability in subsequent releases. Users should upgrade to the latest stable version available from the official Wireshark download page. For detailed information about the security fix, refer to the Wireshark Security Advisory WNPA-SEC-2026-29.

Additional technical details and patch commits can be found in the GitLab Wireshark Work Item #21129.

Workarounds

Disable the Kismet protocol dissector via Edit → Preferences → Protocols → Kismet (uncheck "Decode Kismet protocol")
Process capture files in isolated virtual machines or sandboxed environments
Use command-line tools like tshark with protocol filtering to exclude Kismet dissection
Implement network segmentation to prevent exposure to untrusted Kismet protocol traffic

bash

# Disable Kismet dissector via command line when using tshark
tshark -r capture.pcap --disable-protocol kismet

# Alternative: Create a disabled protocols file
echo "kismet" >> ~/.config/wireshark/disabled_protos