CVE-2026-6535: Wireshark Denial of Service Vulnerability

CVE-2026-6535 Overview

A denial of service vulnerability exists in Wireshark's dissection engine related to zlib decompression handling. The vulnerability affects Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14, allowing attackers to crash the application when processing specially crafted network capture files or live traffic containing malformed compressed data.

Critical Impact
Attackers can cause Wireshark to crash during packet analysis, disrupting network forensics investigations and security monitoring operations.

Affected Products

Wireshark 4.6.0 to 4.6.4
Wireshark 4.4.0 to 4.4.14

Discovery Timeline

2026-04-30 - CVE CVE-2026-6535 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-6535

Vulnerability Analysis

This vulnerability is classified under CWE-1325 (Improper Control of Interaction Frequency), indicating a flaw in how Wireshark's dissection engine handles zlib decompression operations. When parsing network traffic or capture files containing specially crafted compressed data streams, the decompression routine fails to properly validate or control decompression behavior, resulting in an application crash.

The vulnerability requires local access, meaning an attacker must convince a user to open a malicious capture file or capture traffic from a compromised network segment. While no data confidentiality or integrity impact exists, the availability impact is significant as it can completely disrupt ongoing network analysis sessions.

Root Cause

The root cause lies in improper handling within Wireshark's zlib decompression functionality used by the dissection engine. When processing malformed or specially crafted compressed data within network protocols, the decompression routine encounters an unhandled condition that triggers a crash. This represents a failure to properly sanitize and validate compressed data before attempting decompression operations.

Attack Vector

The attack vector requires local access with user interaction. An attacker could exploit this vulnerability through several methods:

Malicious PCAP Files: Crafting a network capture file (.pcap, .pcapng) containing malformed compressed protocol data and distributing it to targets for analysis
Network Traffic Injection: On a compromised network segment, injecting specially crafted packets containing malformed zlib-compressed data that triggers the crash when captured and analyzed
Shared Analysis Environments: Uploading malicious captures to shared repositories or forensics platforms where analysts may open them

The vulnerability triggers during the packet dissection phase when Wireshark attempts to decompress data within supported protocols that utilize zlib compression. For additional technical details, refer to the Wireshark Security Advisory WNPA-SEC-2026-26 and the related GitLab issues (#21097, #21098).

Detection Methods for CVE-2026-6535

Indicators of Compromise

Unexpected Wireshark application crashes during packet capture analysis sessions
Core dumps or crash logs indicating failures in zlib-related dissection functions
Multiple consecutive Wireshark process terminations when opening specific capture files
Error messages related to decompression failures in Wireshark logs

Detection Strategies

Monitor application crash reports for Wireshark processes with stack traces pointing to dissection or decompression functions
Implement file integrity monitoring on shared capture file repositories to detect potentially malicious uploads
Deploy endpoint detection to identify patterns of repeated Wireshark crashes that may indicate exploitation attempts
Review network capture files from untrusted sources in isolated environments before opening in production systems

Monitoring Recommendations

Enable verbose logging in Wireshark to capture error conditions before crashes occur
Configure system-level crash reporting to capture details when Wireshark terminates unexpectedly
Monitor for anomalous network traffic patterns that may indicate attempts to inject malformed compressed data
Track Wireshark version deployments across the organization to identify vulnerable installations

How to Mitigate CVE-2026-6535

Immediate Actions Required

Update Wireshark to the latest patched version beyond 4.6.4 (for 4.6.x branch) or 4.4.14 (for 4.4.x branch)
Avoid opening capture files from untrusted or unknown sources until patching is complete
Consider using alternative packet analysis tools temporarily if updates cannot be applied immediately
Isolate network analysis workstations to minimize exposure to potentially malicious traffic

Patch Information

The Wireshark development team has addressed this vulnerability in releases following the affected versions. Organizations should update to the latest stable release available from the official Wireshark website. For detailed information, consult the Wireshark Security Advisory WNPA-SEC-2026-26.

Workarounds

Analyze untrusted capture files in isolated virtual machines or sandboxed environments to contain potential crashes
Disable protocol dissectors that rely heavily on zlib decompression if the specific protocols are not required for analysis
Use command-line tools like tshark with limited dissector options to reduce attack surface when processing untrusted captures
Implement network segmentation to prevent exposure to potentially malicious compressed traffic on monitored interfaces

bash

# Check current Wireshark version
wireshark --version

# Update Wireshark on Debian/Ubuntu systems
sudo apt update && sudo apt install --only-upgrade wireshark

# Update Wireshark on RHEL/CentOS systems
sudo dnf update wireshark

# Run tshark with limited dissectors for safer analysis of untrusted files
tshark -r suspicious.pcap --disable-protocol http2 --disable-protocol grpc