Loading story…
Wireshark disclosed and patched multiple vulnerabilities in its Catapult DCT2000 handling code, including a protocol dissector crash tracked as CVE-2026-15174 and a separate file parser flaw later assigned CVE-2026-76883. The first issue, published as advisory wnpa-sec-2026-52, affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16 and can be triggered by a malformed packet on the wire or by opening a malformed packet trace file, causing the application to crash.
A later advisory, wnpa-sec-2026-74, covers a Catapult DCT2000 file parser crash affecting versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.17, fixed in 4.6.8 and 4.4.18. Separately, a GitLab issue detailed an off-by-one heap out-of-bounds write in parse_line() within wiretap/catapult_dct2000.c, where the parser allocates floor(data_chars/2) bytes but may write ceil(data_chars/2) bytes when the input length is odd; developers confirmed the bug, noted practical triggering requires exactly 2049 bytes, and merged fixes. Wireshark said no exploits are known for the disclosed issues and advised users to upgrade to patched releases.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
On August 12, 2026, Wireshark published security notice wnpa-sec-2026-74 for a Catapult DCT2000 file parser crash affecting versions 4.6.0 through 4.6.7 and 4.4.0 through 4.4.17. The notice credits Yazan Balawneh of the CyStack Security Team, references issue 21427, and says the flaw was fixed in versions 4.6.8 and 4.4.18.
A GitLab issue created on July 21, 2026 reported a distinct heap out-of-bounds write in Wireshark's Catapult DCT2000 wiretap file reader, caused by an off-by-one allocation bug in parse_line(). The report, submitted by Yazan Balawneh of the CyStack Security Team, noted the flaw was separate from wnpa-sec-2026-52 / CVE-2026-15174 and included a proof-of-concept malformed file.
On July 8, 2026, Wireshark disclosed security advisory wnpa-sec-2026-52 for a Catapult DCT2000 protocol dissector crash tracked as CVE-2026-15174. The issue affects versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16, and Wireshark said it was fixed in 4.6.7 and 4.4.17.
Wireshark developers confirmed and fixed the Catapult DCT2000 file reader bug through merged merge requests tied to issue 21427, and Gerald Combs later stated the vulnerability had been assigned CVE-2026-76883. The issue record says it was initially handled as a security issue before being made publicly visible.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
wireshark.org
Open sourcegitlab.com
Open sourcewireshark.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed and patched a high-severity vulnerability in its C12.22 protocol dissector that can crash the application when processing malformed traffic or packet captures. The flaw, tracked as **CVE-2026-76886** and covered by advisory **`wnpa-sec-2026-75`**, stems from the EAX/CMAC decryption path, where `Eax_Decrypt()` accepts 32-bit lengths but passes them into 16-bit CMAC helper logic, causing integer truncation, undersized heap allocation, and subsequent oversized `memcpy()` operations that lead to a heap-buffer overflow. The vulnerable code path is reachable through reassembled C12.22 traffic over **TCP/1153** when **`c1222.decrypt`** is enabled and a matching decryption-table entry exists; researchers reported that a crafted **65,576-byte** MESSAGE can reliably trigger the crash. Wireshark said affected versions are **4.6.0 through 4.6.7** and **4.4.0 through 4.4.17**, with fixes released in **4.6.8** and **4.4.18** that reject oversized CMAC inputs before allocation. The issue was reported by researchers from **Aisle Research, O2Lab, and TAMU**, and Wireshark said no active exploits are known.
Aug 21, 2026
Wireshark disclosed **CVE-2026-5653**, a heap-based buffer overflow in its DCP-ETSI protocol dissector that can crash the network protocol analyzer and cause a denial of service. The flaw affects Wireshark versions `4.6.0` through `4.6.4` and `4.4.0` through `4.4.14`, and was assigned **CWE-122** with a **CVSS v3.1 score of 5.5**. According to the advisory, an attacker could trigger the issue by injecting a malformed packet onto the network or by convincing a user to open a crafted packet capture file. Wireshark fixed the vulnerability in versions `4.6.5` and `4.4.15`; the issue was discovered by Alexandre de Oliveira, and the vendor said no active exploits were known at the time of disclosure.
Aug 21, 2026
Wireshark has released version **4.6.7**, a maintenance update that fixes **12 security vulnerabilities** affecting the processing of untrusted packets and capture or trace files. The flaws primarily allowed crashes through out-of-bounds reads, invalid memory access, and large or infinite processing loops triggered by crafted network traffic or malformed files, while one issue in the **BLF** parser could lead to information disclosure. The patched areas span multiple protocol dissectors and parsers, including **Catapult DCT2000**, **SSH**, **IEEE 802.11**, **Z39.50**, **UMTS FP**, the **pcapng** reader, **DBS Etherwatch**, the **TLS ECH** decryption path, and the **CiscoDump extcap** helper. The release also fixes **16 non-security bugs**, updates several protocol handlers, and notes that on Unix-like systems, `extcap` binaries are now searched under the **libexec** directory by default.
Jul 11, 2026