Loading story…
Wireshark disclosed CVE-2026-6870, a crash-causing flaw in its GSM RP protocol dissector that can be triggered by a malformed packet on the network or by opening a crafted packet capture file. The bug was traced to a stale global g_tree in packet-gsm_a_rp.c when RP User-Data is dissected through the BSSMAP VGCS-SMS path, leading to a heap-buffer-overflow read and application crash in Wireshark and TShark.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
On April 29, 2026, Wireshark published security notice wnpa-sec-2026-43 for CVE-2026-6870, describing a GSM RP protocol dissector crash. The advisory said affected versions include 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14, and that malformed network traffic or packet trace files could trigger the crash.
Wireshark said the vulnerability was fixed in versions 4.6.5 and 4.4.15 and advised users to upgrade. The advisory also noted that no exploits were known at the time of publication.
The Wireshark GSM RP dissector flaw was assigned identifier CVE-2026-6870. The assignment was noted in the GitLab issue and reflected in the CVE record.
Upstream maintainers merged fixes titled "GSM RP: Don't use a global" and closed the Wireshark issue as Done. The issue record links the closure to commit 6fc954bb and merge requests !24357, !24364, and !24365.
A vulnerability in Wireshark/TShark's GSM RP dissector was reported in GitLab issue #21189. The report described a stale global g_tree in packet-gsm_a_rp.c that can cause a heap-buffer-overflow read and crash when RP User-Data is dissected via BSSMAP VGCS-SMS.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcewireshark.org
Open sourcegitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed **CVE-2026-3203**, a crash vulnerability in its RF4CE Profile dissector that can be triggered by malformed RF4CE/ZigBee traffic or a crafted packet capture file. The issue was uncovered during internal fuzz testing, which found that `tshark` on the `release-4.6` branch could hit a segmentation fault while processing a crafted capture derived from an RF4CE example file. AddressSanitizer traced the invalid read to RF4CE and ZigBee decryption code, including `zbee_sec_ccm_decrypt` in `packet-zbee-security.c` and related RF4CE dissector paths.
Aug 21, 2026
Wireshark disclosed and fixed memory-safety flaws in its UMTS FP dissector that could be triggered by malformed network traffic or crafted packet capture files opened in **Wireshark**, `tshark`, or `sharkd`. One issue, tracked as **CVE-2026-15169** and published as **wnpa-sec-2026-59**, stems from `dissect_e_dch_t2_or_common_channel_info()` writing past a static `subframes[16]` array in the UMTS FP E-DCH Type-2 parser, enabling memory corruption and at minimum a reliable denial of service. Wireshark said the bug affects versions **4.6.0 through 4.6.6** and **4.4.0 through 4.4.16**, and was fixed in **4.6.7** and **4.4.17**. A related flaw in the same function was later assigned **CVE-2026-76889** after researchers showed that a packet-controlled continuation flag could keep MAC-is descriptor parsing running beyond 16 entries, causing fixed-array out-of-bounds writes to `mac_is_lchid[pdu_no][16]` and `mac_is_length[pdu_no][16]`. The bugs were reproduced with sanitizers against development and pre-release builds, and Wireshark closed the reports after merging fixes including **!25692** for UMTS-FP limits checking and **!25780** for the MAC-is descriptor handling issue. The disclosures indicate the vulnerabilities could be exploited through injected malformed packets or malicious trace files, although no public exploits were reported at disclosure time.
Aug 21, 2026
Wireshark disclosed **CVE-2026-76919**, a flaw in its ESS protocol dissector that can crash the application when it processes malformed BER `BIT STRING` data. The bug stems from generated ESS dissector code that can pass an uninitialized `tvbuff_t *` pointer into attribute-flag post-processing after BER decoding paths return without assigning it; a crafted zero-length `BIT STRING` such as: ```hex 03 00 ``` can trigger a dissector exception, abort, crash, or unsafe native memory access in Wireshark or TShark.
Aug 21, 2026