CVE-2026-6867: Wireshark SMB2 DOS Vulnerability

CVE-2026-6867 Overview

CVE-2026-6867 is a denial of service vulnerability in the Server Message Block version 2 (SMB2) protocol dissector of Wireshark. The flaw affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. An attacker can trigger a crash of the dissector by supplying a malformed capture file or by injecting crafted packets onto a network being captured. Successful exploitation terminates the Wireshark process, disrupting packet analysis workflows used by network engineers and incident responders. The issue is tracked under [CWE-1325] (Improperly Controlled Sequential Memory Allocation) and disclosed in Wireshark Security Advisory WNPA-SEC-2026-45.

Critical Impact
Local user interaction with a crafted capture file or packet stream crashes the Wireshark SMB2 dissector, producing a high-impact denial of service on the analyst workstation.

Affected Products

Wireshark 4.6.0 through 4.6.4
Wireshark 4.4.0 through 4.4.14
Wireshark SMB2 protocol dissector component

Discovery Timeline

2026-04-30 - CVE-2026-6867 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-6867

Vulnerability Analysis

The vulnerability resides in the SMB2 protocol dissector that Wireshark uses to parse SMB2 traffic during live capture or offline file analysis. The dissector mishandles input that drives sequential memory allocation, leading to a crash of the application. The advisory categorizes the weakness under [CWE-1325], which describes improperly controlled sequential allocation patterns that can be abused by malformed protocol data. The result is loss of availability for the Wireshark process and any in-progress analysis session.

Root Cause

The SMB2 dissector does not adequately validate length, count, or offset fields before iterating allocations during packet parsing. When the dissector processes a malformed SMB2 message, the allocation logic enters a state that the process cannot recover from, terminating execution. The advisory wnpa-sec-2026-45 and tracking item GitLab Work Item #21191 document the affected code paths and the corresponding fix.

Attack Vector

Exploitation requires local access and user interaction. An attacker delivers a crafted .pcap or .pcapng capture file to an analyst, who then opens it in Wireshark, or injects malicious SMB2 packets onto a network segment that the analyst is actively capturing. No authentication or elevated privileges are required. The vulnerability does not yield code execution, information disclosure, or integrity loss; impact is limited to crashing the dissector and the Wireshark process. No public proof-of-concept exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

The vulnerability manifests when the SMB2 dissector parses fields that drive allocation loops. See GitLab Work Item #21191 for the technical fix details.

Detection Methods for CVE-2026-6867

Indicators of Compromise

Unexpected Wireshark or tshark process crashes shortly after opening a capture file or starting a live capture on SMB-bearing segments.
Capture files containing malformed SMB2 headers, oversized field counts, or anomalous sequential record patterns delivered from untrusted sources.
Repeated crash dumps or core files generated by wireshark or dumpcap on analyst workstations.

Detection Strategies

Inventory Wireshark installations across the environment and flag hosts running versions 4.6.0–4.6.4 or 4.4.0–4.4.14.
Monitor endpoint telemetry for abnormal termination of wireshark.exe, tshark.exe, or dumpcap.exe correlated with recent file opens.
Inspect inbound capture files received via email, file shares, or ticketing systems for SMB2 traffic from unknown sources before analysis.

Monitoring Recommendations

Alert on process crash events for Wireshark binaries on analyst and incident-response workstations.
Track file provenance for .pcap and .pcapng artifacts handled by security teams.
Subscribe to the Wireshark security advisory feed to receive future dissector vulnerability notices.

How to Mitigate CVE-2026-6867

Immediate Actions Required

Upgrade Wireshark to a fixed release above 4.6.4 in the 4.6.x branch or above 4.4.14 in the 4.4.x branch as published in WNPA-SEC-2026-45.
Restrict opening of capture files from untrusted or unverified sources on analyst systems.
Isolate packet-analysis activities to dedicated, non-production workstations where a crash carries minimal operational cost.

Patch Information

The Wireshark Foundation has released fixed versions addressing CVE-2026-6867. Refer to Wireshark Security Advisory WNPA-SEC-2026-45 for the patched releases and to GitLab Work Item #21191 for the upstream code change. Apply the vendor-supplied installers or distribution package updates to bring all analyst workstations into a patched state.

Workarounds

Disable the SMB2 dissector in Wireshark via Analyze → Enabled Protocols until the patched version is deployed.
Use tshark with explicit protocol disable flags such as --disable-protocol smb2 when processing untrusted captures.
Pre-filter capture files with a hardened tool to strip SMB2 frames before opening them in a vulnerable Wireshark build.

bash

# Configuration example
# Process a capture without invoking the SMB2 dissector
tshark -r untrusted.pcapng --disable-protocol smb2 -V > analysis.txt