Loading story…
Wireshark disclosed CVE-2026-5653, a heap-based buffer overflow in its DCP-ETSI protocol dissector that can crash the network protocol analyzer and cause a denial of service. The flaw affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14, and was assigned CWE-122 with a CVSS v3.1 score of 5.5.
According to the advisory, an attacker could trigger the issue by injecting a malformed packet onto the network or by convincing a user to open a crafted packet capture file. Wireshark fixed the vulnerability in versions 4.6.5 and 4.4.15; the issue was discovered by Alexandre de Oliveira, and the vendor said no active exploits were known at the time of disclosure.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2026-5653 was published, describing the Wireshark DCP-ETSI issue as a heap-based buffer overflow that can cause denial of service by crashing the application. The record credits Alexandre de Oliveira, references WNPA-SEC-2026-22 and issue 21122, and lists fixed versions 4.6.5 and 4.4.15.
Wireshark published advisory WNPA-SEC-2026-22 for CVE-2026-5653, a DCP-ETSI dissector flaw that can crash Wireshark when processing malformed network traffic or packet capture files. The advisory says affected versions are 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14, and that the issue was fixed in versions 4.6.5 and 4.4.15.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed a denial-of-service vulnerability in its BEEP protocol dissector that can crash the packet analyzer through a stack-call overflow caused by recursive function handling. The issue is tracked as **CVE-2026-6538** and documented in advisory **`wnpa-sec-2026-23`**, with the underlying bug reported in Wireshark's issue tracker as a BEEP dissector stack-call overflow. The flaw affects Wireshark versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**. According to the vendor, an attacker could trigger the crash by injecting a malformed packet onto the network or by convincing a user to open a crafted capture file. Wireshark said no active exploits are known, credited Sharon Brizinov with discovery, and released fixes in versions **4.6.5** and **4.4.15**.
Aug 21, 2026
Wireshark disclosed and patched a high-severity vulnerability in its C12.22 protocol dissector that can crash the application when processing malformed traffic or packet captures. The flaw, tracked as **CVE-2026-76886** and covered by advisory **`wnpa-sec-2026-75`**, stems from the EAX/CMAC decryption path, where `Eax_Decrypt()` accepts 32-bit lengths but passes them into 16-bit CMAC helper logic, causing integer truncation, undersized heap allocation, and subsequent oversized `memcpy()` operations that lead to a heap-buffer overflow. The vulnerable code path is reachable through reassembled C12.22 traffic over **TCP/1153** when **`c1222.decrypt`** is enabled and a matching decryption-table entry exists; researchers reported that a crafted **65,576-byte** MESSAGE can reliably trigger the crash. Wireshark said affected versions are **4.6.0 through 4.6.7** and **4.4.0 through 4.4.17**, with fixes released in **4.6.8** and **4.4.18** that reject oversized CMAC inputs before allocation. The issue was reported by researchers from **Aisle Research, O2Lab, and TAMU**, and Wireshark said no active exploits are known.
Aug 21, 2026
Wireshark disclosed **CVE-2026-6868**, a stack-based buffer overflow in its HTTP protocol dissector that can cause a denial of service by crashing the application. The flaw affects Wireshark versions `4.6.0` through `4.6.4` and `4.4.0` through `4.4.14`, and can be triggered if an attacker injects a malformed packet onto the network or convinces a user to open a crafted packet capture file.
Aug 21, 2026