Loading story…
Wireshark disclosed CVE-2026-3201, a denial-of-service flaw in its USB HID dissector that can cause excessive memory consumption and make Wireshark or TShark hang or crash. The bug is tied to parse_report_descriptor() in packet-usb-hid.c, where crafted HID USAGE_MINIMUM and USAGE_MAXIMUM values can drive uncontrolled growth through wmem_array_grow() when a malformed pcap or pcapng file is processed.
The issue, tracked as Wireshark issue #20972, was described as a regression of an earlier fix that had added a descriptor count limit. Wireshark said the vulnerability affects versions 4.6.0 through 4.6.3 and 4.4.0 through 4.4.13, and can be triggered either by injecting a malformed packet or by convincing a user to open a malicious trace file. The vendor credited Qi Kery with discovery, said it was unaware of active exploitation, and released fixes in 4.6.4 and 4.4.14.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Wireshark stated that the USB HID memory exhaustion issue was fixed in versions 4.6.4 and 4.4.14, and recommended users upgrade to those releases or later. The GitLab issue also indicates the bug was closed after related merge requests were merged.
Wireshark published security notice wnpa-sec-2026-05 for CVE-2026-3201, disclosing a USB HID dissector memory exhaustion vulnerability affecting versions 4.6.0 through 4.6.3 and 4.4.0 through 4.4.13. The advisory said Wireshark was unaware of active exploits and credited Qi Kery with discovering the issue.
A GitLab issue documented a denial-of-service vulnerability in Wireshark's USB HID dissector, where crafted HID USAGE_MINIMUM and USAGE_MAXIMUM values in a pcap or pcapng file could trigger excessive memory allocation in parse_report_descriptor(). The issue was tracked as Wireshark issue 20972 and later assigned CVE-2026-3201.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
wireshark.org
Open sourcecve.mitre.org
Open sourcegitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed **CVE-2026-6531**, an uncontrolled resource consumption flaw in the SANE protocol dissector that can cause **Wireshark** or **tshark** to hang indefinitely at **100% CPU** while parsing a crafted packet. The bug is in `dissect_control_option_value()` in `packet-sane.c`, where an attacker-controlled `array_length` can drive an effectively empty loop for up to roughly `2^31` iterations when an invalid or unrecognized `value_type` is processed. The issue is reachable through SANE `SANE_NET_CONTROL_OPTION` request and response parsing on TCP port `6566`, and a single crafted **119-byte Ethernet frame** was reported as sufficient to trigger the condition. Wireshark said the vulnerability affects versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**, and that fixes were released in **4.6.5** and **4.4.15**. Upstream issue tracking also noted the flaw in the 4.7.0 development line before the report was closed and linked to merged fixes. The vendor classified the bug as a denial-of-service condition caused by an infinite loop in SANE packet dissection and tied its advisory to public bug report **#21139**.
Aug 21, 2026
Wireshark disclosed **wnpa-sec-2026-61** for multiple infinite-loop vulnerabilities in its protocol dissectors, warning that malformed traffic or crafted capture files could drive excessive CPU consumption during analysis. The affected components include the **MIH**, **MPEG DSM-CC**, **eDonkey**, and **MEGACO** dissectors, and the vendor said the flaws affect Wireshark **4.6.0 through 4.6.6** and **4.4.0 through 4.4.16**. Fixed releases are **4.6.7** and **4.4.17**, and Wireshark said it was not aware of exploitation at disclosure time. The bugs were uncovered by Wireshark's internal fuzzing pipeline, which repeatedly crashed `tshark` on malformed `.pcap` inputs. GitLab issue reports show one flaw in the **MPEG DSM-CC** dissector where parsing failed to advance offsets in a loop, and another in the **eDonkey** dissector where list parsing allowed offsets to move backward, both leading to aborts consistent with infinite-loop conditions; one issue was tracked as **`CVE-2026-15163`**. Wireshark's advisory says an attacker could trigger the condition either by injecting malformed packets onto a network or by convincing a user to open a malicious capture file.
Aug 21, 2026
Wireshark disclosed **CVE-2026-5653**, a heap-based buffer overflow in its DCP-ETSI protocol dissector that can crash the network protocol analyzer and cause a denial of service. The flaw affects Wireshark versions `4.6.0` through `4.6.4` and `4.4.0` through `4.4.14`, and was assigned **CWE-122** with a **CVSS v3.1 score of 5.5**. According to the advisory, an attacker could trigger the issue by injecting a malformed packet onto the network or by convincing a user to open a crafted packet capture file. Wireshark fixed the vulnerability in versions `4.6.5` and `4.4.15`; the issue was discovered by Alexandre de Oliveira, and the vendor said no active exploits were known at the time of disclosure.
Aug 21, 2026