CVE-2026-6536: Wireshark DLMS/COSEM DoS Vulnerability

CVE-2026-6536 Overview

CVE-2026-6536 is an infinite loop vulnerability affecting the DLMS/COSEM protocol dissector in Wireshark versions 4.6.0 through 4.6.4. This Denial of Service vulnerability allows an attacker to craft malicious network traffic or capture files that, when processed by Wireshark, cause the application to enter an infinite loop and become unresponsive.

Critical Impact

Exploitation of this vulnerability can cause Wireshark to hang indefinitely when analyzing specially crafted network packets, effectively denying service to network security analysts and incident responders who rely on Wireshark for traffic analysis.

Affected Products

• Wireshark 4.6.0
• Wireshark 4.6.1
• Wireshark 4.6.2
• Wireshark 4.6.3
• Wireshark 4.6.4

Discovery Timeline

• 2026-04-30 - CVE CVE-2026-6536 published to NVD
• 2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-6536

Vulnerability Analysis

This vulnerability is classified as CWE-835 (Loop with Unreachable Exit Condition), commonly known as an infinite loop. The DLMS/COSEM (Device Language Message Specification/Companion Specification for Energy Metering) protocol dissector in Wireshark contains a flaw where certain malformed packet data causes the parsing logic to enter a loop that never terminates.

The DLMS/COSEM protocol is widely used in smart metering infrastructure and energy management systems. When Wireshark attempts to decode packets conforming to this protocol, the dissector processes structured data fields. A specially crafted packet can trigger a condition where the loop's exit criteria are never satisfied, causing Wireshark to consume CPU resources indefinitely.

This requires local access, as the attacker must either provide a malicious capture file to the victim or convince them to capture traffic containing malicious packets on a network the attacker can influence.

Root Cause

The root cause lies in the DLMS/COSEM protocol dissector's packet parsing logic, which contains a loop with an unreachable exit condition (CWE-835). When processing certain malformed or adversarially crafted protocol data units, the dissector fails to properly validate loop termination conditions, resulting in infinite iteration.

Attack Vector

The attack vector is local (AV:L), requiring user interaction (UI:R). An attacker can exploit this vulnerability through two primary methods:

1. Malicious Capture File: The attacker provides a crafted .pcap or .pcapng file containing DLMS/COSEM packets designed to trigger the infinite loop. When the victim opens this file in Wireshark, the application hangs.

2. Network Traffic Injection: If the attacker has access to a network being monitored by the victim, they can inject malicious DLMS/COSEM packets. When the victim captures and analyzes this traffic, Wireshark becomes unresponsive.

The vulnerability results in a denial of service condition affecting availability (A:H) without impacting confidentiality (C:N) or integrity (I:N).

Detection Methods for CVE-2026-6536

Indicators of Compromise

• Wireshark process consuming 100% CPU on a single core for extended periods
• Wireshark application becoming unresponsive when opening specific capture files
• Capture files containing DLMS/COSEM protocol traffic from untrusted sources
• User reports of Wireshark freezing during protocol analysis tasks

Detection Strategies

• Monitor for Wireshark processes with abnormally high CPU utilization that persist beyond typical analysis timeframes
• Implement endpoint detection rules that alert on Wireshark process hangs or unresponsive states
• Review capture files received from external sources before opening in production Wireshark installations
• Use file integrity monitoring to detect potentially malicious capture files in analysis directories

Monitoring Recommendations

• Deploy SentinelOne endpoint protection to detect and respond to abnormal application behavior patterns
• Configure process monitoring to alert when Wireshark CPU usage exceeds thresholds for extended durations
• Maintain logs of capture file sources and origins for forensic analysis if exploitation is suspected
• Implement network segmentation to limit exposure of analysis workstations to potentially malicious traffic

How to Mitigate CVE-2026-6536

Immediate Actions Required

• Upgrade Wireshark to a patched version beyond 4.6.4 when available from the Wireshark project
• Avoid opening capture files from untrusted or unknown sources until patched
• Consider using TShark with protocol filters to exclude DLMS/COSEM dissection when analyzing untrusted captures
• Disable the DLMS/COSEM dissector via Wireshark's Analyze > Enabled Protocols menu if not required for analysis

Patch Information

Wireshark has issued security advisory WNPA-SEC-2026-25 addressing this vulnerability. Users should monitor the Wireshark project for updated releases that remediate this issue. Technical details and issue tracking are available via the GitLab Wireshark Issue.

Workarounds

• Disable the DLMS/COSEM protocol dissector in Wireshark's Enabled Protocols configuration if this protocol is not required for your analysis workflow
• Use Wireshark's -d command-line option to disable specific dissectors when processing untrusted capture files
• Analyze potentially malicious captures in an isolated virtual machine to contain any denial of service impact
• Consider using alternative packet analysis tools for examining captures from untrusted sources until a patch is applied

# Disable DLMS/COSEM dissector via command line
wireshark -o "dlms_cosem.enable:FALSE" suspicious_capture.pcapng

# Alternative: Use TShark with decode-as to skip DLMS/COSEM processing
tshark -r capture.pcapng --disable-protocol dlms_cosem