CVE-2026-6537: Wireshark ZigBee Protocol DoS Vulnerability

CVE-2026-6537 Overview

A denial of service vulnerability exists in Wireshark's ZigBee protocol dissector that affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. The vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), which can cause the application to crash when processing maliciously crafted network traffic or capture files containing ZigBee protocol data.

Critical Impact
Attackers can crash Wireshark instances by sending or providing malformed ZigBee protocol packets, disrupting network analysis operations and potentially affecting security monitoring capabilities.

Affected Products

Wireshark 4.6.0 to 4.6.4
Wireshark 4.4.0 to 4.4.14

Discovery Timeline

2026-04-30 - CVE CVE-2026-6537 published to NVD
2026-04-30 - Last updated in NVD database

Technical Details for CVE-2026-6537

Vulnerability Analysis

The vulnerability resides in Wireshark's ZigBee protocol dissector component, which is responsible for parsing and analyzing ZigBee wireless communication protocol packets. When the dissector processes specially crafted ZigBee protocol data, it triggers a stack-based buffer overflow condition (CWE-121) that results in application crash.

This vulnerability requires local access and user interaction to exploit, meaning an attacker would need to convince a user to open a malicious capture file or capture traffic containing the exploit payload. The attack does not compromise confidentiality or integrity but has a high impact on availability, effectively denying service to network analysts relying on Wireshark for packet inspection.

Root Cause

The root cause is a stack-based buffer overflow (CWE-121) in the ZigBee protocol dissector. This type of vulnerability occurs when the dissector writes data beyond the boundaries of a stack-allocated buffer while processing ZigBee protocol fields. The overflow corrupts adjacent stack memory, leading to application instability and crash.

Attack Vector

The attack vector is local with required user interaction. An attacker can exploit this vulnerability through the following methods:

Malicious Capture Files: Creating a specially crafted .pcap or .pcapng file containing malformed ZigBee protocol data and distributing it to targets
Live Traffic Capture: If the target is capturing ZigBee network traffic, an attacker on the same network segment could inject malformed ZigBee packets that trigger the vulnerability when parsed

The vulnerability affects the availability of Wireshark, causing the application to crash. While no data exfiltration or code execution has been confirmed, the denial of service can disrupt critical network forensics and monitoring activities.

For technical details on the specific implementation flaw, see the GitLab Wireshark Issue and the Wireshark Security Advisory WNPA-SEC-2026-24.

Detection Methods for CVE-2026-6537

Indicators of Compromise

Unexpected Wireshark process terminations or crashes during ZigBee protocol analysis
Core dumps or crash reports generated by Wireshark referencing the ZigBee dissector
Suspicious .pcap or .pcapng files containing malformed ZigBee protocol data
Repeated application crashes when opening specific capture files

Detection Strategies

Monitor for abnormal Wireshark process terminations, particularly when analyzing ZigBee traffic
Implement file integrity checks on capture files before opening them in Wireshark
Use automated crash reporting tools to identify patterns in Wireshark failures
Deploy endpoint detection solutions to identify exploitation attempts

Monitoring Recommendations

Enable application crash logging on systems running Wireshark
Monitor for unusual ZigBee protocol traffic patterns on network segments
Track Wireshark version deployments across the organization to identify vulnerable instances
Review system event logs for repeated application failures

How to Mitigate CVE-2026-6537

Immediate Actions Required

Upgrade Wireshark to version 4.6.5 or later (for 4.6.x branch) or 4.4.15 or later (for 4.4.x branch)
Avoid opening capture files from untrusted sources until patched
Consider disabling the ZigBee protocol dissector if not required for analysis
Implement network segmentation to limit exposure to potential exploit traffic

Patch Information

Wireshark has released security updates to address this vulnerability. Users should update to the latest available version in their respective release branches. Detailed patch information and downloads are available through the Wireshark Security Advisory WNPA-SEC-2026-24.

Workarounds

Disable the ZigBee protocol dissector via Analyze → Enabled Protocols menu if ZigBee analysis is not required
Use alternative packet analysis tools for ZigBee traffic until patching is complete
Run Wireshark in an isolated environment or sandbox when analyzing untrusted captures
Implement strict file validation policies for capture files shared within the organization

bash

# Disable ZigBee dissector via command line
wireshark --disable-protocol zigbee