Loading story…
Wireshark disclosed CVE-2026-7379, a memory leak in the sharkd utility that can be triggered by repeated JSON-RPC capture load requests. The flaw stems from cf_open overwriting existing capture state without freeing prior wtap allocations, allowing memory use to grow without bound and potentially enabling resource exhaustion by an unauthenticated attacker with access to the sharkd socket. A public bug report demonstrated the issue with repeated pcap load operations under AddressSanitizer, which identified hundreds of leaked allocations.
The vendor published advisory wnpa-sec-2026-47 and said the issue affects Wireshark 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. Wireshark reported no known exploitation in the wild, but warned that the bug may cause sharkd to consume excessive CPU resources. The issue was fixed by adding cleanup logic to close prior capture state, and users were advised to upgrade to 4.6.5 or 4.4.15.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
In the advisory, Wireshark said the vulnerability was fixed in versions 4.6.5 and 4.4.15 and advised users to upgrade to those releases or later. The issue was tracked as CVE-2026-7379.
Wireshark published security advisory wnpa-sec-2026-47 for CVE-2026-7379, stating that sharkd could leak memory and that no exploits were known in the wild. The advisory said affected versions were 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14.
A GitLab issue was filed describing a memory leak in sharkd's cf_open function, where repeated JSON-RPC load requests overwrite capture state without freeing prior allocations. The report said an unauthenticated attacker with access to the sharkd socket could trigger unbounded memory growth and denial of service.
The sharkd memory leak issue was subsequently assigned the identifier CVE-2026-7379. The CVE linked the vulnerability report to Wireshark's tracked security issue.
The issue was later closed after merge requests !24462, !24464, and !24465 were merged, implementing a skeleton of cf_close and calling it to prevent the leak. This resolved the bug tracked in issue 21214.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed **CVE-2026-7378**, a flaw in the `sharkd` utility that can cause the daemon to crash when filter state from a previously loaded capture file is reused in the same session. The issue affects Wireshark versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**, and has been fixed in **4.6.5** and **4.4.15**. Wireshark said it is not aware of active exploitation and credited the discovery to **Alexandre de Oliveira**. The underlying bug was traced to a **heap-buffer-overflow** in `sharkd`'s `frames` method, where cached filter bitmaps were kept in a session-wide hash table and not invalidated when a new capture file was loaded. That allowed a bitmap sized for one capture to be reused against a later capture with a different frame count, leading to an out-of-bounds read in `sharkd_session_process_frames`. Maintainers said triggering the flaw requires loading two captures in one session, reusing the same filter string, and making the second capture larger under specific matching conditions; the fix clears the filter table whenever a new file is loaded.
Aug 21, 2026
Wireshark disclosed a vulnerability in its `sharkd` backend, tracked as **CVE-2026-76890**, after researchers found a use-after-return bug in `sharkd_session_process_iograph()`. The flaw stems from tap listeners being registered from a stack-allocated graphs array and not being removed on an error path, leaving global callbacks pointing to freed memory. A later attacker-controlled retap can invoke `sharkd_iograph_packet()` on the stale pointer, causing memory corruption and a reliable crash; the issue affects `sharkd` specifically rather than `tshark`. The vendor said malformed packets delivered on the network or through a crafted capture file could trigger the crash in affected releases. Wireshark reported that versions **4.6.0 through 4.6.7** and **4.4.0 through 4.4.17** are vulnerable, and fixed the issue in **4.6.8** and **4.4.18**; the original bug report said the flaw traces back to releases starting with **3.6.0**. The vulnerability was reported by David Korczynski of Ada Logics and credited to findings by Claude and Ada Logics, and Wireshark said no active exploits are known.
Aug 21, 2026
Wireshark disclosed and patched a broad set of vulnerabilities across its packet analysis engine, protocol dissectors, codecs, decompression routines, and the `sharkd` backend, with the most serious issues including possible code execution, memory corruption, and denial of service. The release notes for **Wireshark 4.6.6** aggregate advisories `wnpa-sec-2026-08` through `wnpa-sec-2026-50`, while earlier coordinated fixes shipped in **4.6.5** and **4.4.15** for affected `4.6.0-4.6.4` and `4.4.0-4.4.14` branches. One high-severity flaw, tracked as **CVE-2026-5656**, allowed a crafted configuration-profile ZIP to escape the intended extraction path and plant a Lua plugin for execution on the next launch. Additional issues included crashes and memory-safety bugs in AMR-NB (`CVE-2026-5654`), iLBC (`CVE-2026-5657`), ASN.1 PER (`CVE-2026-6527`), DCP-ETSI (`CVE-2026-5653`, `CVE-2026-6530`), and later `sharkd` and Bluetooth AVRCP flaws that could crash the process or potentially enable control-flow hijack. Several vulnerabilities were reachable simply by opening a malicious packet capture or by parsing malformed traffic on the wire. Wireshark documented infinite-loop and CPU-exhaustion conditions in the USB HID dissector (**CVE-2026-6534**), OpenFlow v5 dissector (**CVE-2026-6521**), and LZ77 decompression path (**CVE-2026-6533**), alongside crashes in BEEP (**CVE-2026-6538**) and other protocol handlers. GitLab issue reports show researchers and fuzzing jobs repeatedly triggering heap overflows, double-free conditions, NULL dereferences, and non-advancing-offset parser failures in components such as DCP-ETSI, H.245, MIH, eDonkey, and `sharkd`, underscoring that malformed captures can destabilize both the GUI and `tshark`. Wireshark said it was not aware of active exploitation at disclosure time and urged users to update to the fixed releases.
Aug 21, 2026