Loading story…
Wireshark disclosed and fixed CVE-2026-15166, a stack-based buffer overflow in 802.11 EAPOL-Key decryption handling within Dot11DecryptDecryptKeyData(). The flaw stems from attacker-controlled EAPOL length fields reaching a memcpy into a fixed 1024-byte stack buffer without proper bounds checking on the decrypt path, allowing a malformed frame to corrupt the stack. The issue was reported in Wireshark's tshark processing and was reproduced with AddressSanitizer against commit b260b00b861aef491d11043d2a8c9dd2615cdb9e using the shipped wpa-Induction.pcap test capture.
Wireshark said the vulnerability affects versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16, and could let an attacker crash the application by convincing a user to open a malformed packet trace file. The original report said that, when WPA decryption is enabled and a valid Security Association exists for the BSSID, a single crafted EAPOL-Key frame can overflow the buffer by roughly 1000 bytes, creating potential RCE-class impact in addition to denial of service. Wireshark released fixes in 4.6.7 and 4.4.17 and said it was not aware of active exploitation.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On July 8, 2026, Wireshark published advisory wnpa-sec-2026-57 for CVE-2026-15166, describing an IEEE 802.11 dissector crash affecting versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. Wireshark said it was unaware of exploits and released fixes in versions 4.6.7 and 4.4.17.
Ada Logics reported a stack-based buffer overflow in Wireshark's tshark 802.11 EAPOL-Key decryption path, where attacker-controlled length fields could drive a memcpy into a fixed 1024-byte stack buffer. The GitLab issue says the flaw was reproduced with AddressSanitizer and was later assigned CVE-2026-15166.
Wireshark closed the issue after merge request !25682 was merged, with additional related merge requests !25687 and !25688 also merged. The fix was described as checking for overly large values in EAPOL frames to prevent the overflow condition.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
wireshark.org
Open sourcegitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed and patched a high-severity vulnerability in its C12.22 protocol dissector that can crash the application when processing malformed traffic or packet captures. The flaw, tracked as **CVE-2026-76886** and covered by advisory **`wnpa-sec-2026-75`**, stems from the EAX/CMAC decryption path, where `Eax_Decrypt()` accepts 32-bit lengths but passes them into 16-bit CMAC helper logic, causing integer truncation, undersized heap allocation, and subsequent oversized `memcpy()` operations that lead to a heap-buffer overflow. The vulnerable code path is reachable through reassembled C12.22 traffic over **TCP/1153** when **`c1222.decrypt`** is enabled and a matching decryption-table entry exists; researchers reported that a crafted **65,576-byte** MESSAGE can reliably trigger the crash. Wireshark said affected versions are **4.6.0 through 4.6.7** and **4.4.0 through 4.4.17**, with fixes released in **4.6.8** and **4.4.18** that reject oversized CMAC inputs before allocation. The issue was reported by researchers from **Aisle Research, O2Lab, and TAMU**, and Wireshark said no active exploits are known.
Aug 21, 2026
Wireshark disclosed **CVE-2026-5653**, a heap-based buffer overflow in its DCP-ETSI protocol dissector that can crash the network protocol analyzer and cause a denial of service. The flaw affects Wireshark versions `4.6.0` through `4.6.4` and `4.4.0` through `4.4.14`, and was assigned **CWE-122** with a **CVSS v3.1 score of 5.5**. According to the advisory, an attacker could trigger the issue by injecting a malformed packet onto the network or by convincing a user to open a crafted packet capture file. Wireshark fixed the vulnerability in versions `4.6.5` and `4.4.15`; the issue was discovered by Alexandre de Oliveira, and the vendor said no active exploits were known at the time of disclosure.
Aug 21, 2026
Wireshark disclosed and fixed **CVE-2026-15167**, a heap buffer overflow in the DBS Etherwatch capture file parser that can be triggered by opening a crafted packet trace file. The flaw was reported in `wiretap/dbs-etherwatch.c`, where bytes from a textual hex dump were written into a record buffer without per-write bounds checks, allowing attacker-controlled data to be written past a heap allocation. The issue was reproduced deterministically with AddressSanitizer and was considered especially serious for `libwiretap` in headless parsing workflows, while desktop users could also be affected by simply opening a malicious file. According to Wireshark's advisory, the vulnerability can crash the application and cause a denial-of-service condition. Affected releases include **Wireshark 4.6.0 through 4.6.6** and **4.4.0 through 4.4.16**, and fixes were released in **4.6.7** and **4.4.17**. The original issue was tracked in GitLab and later closed after the fix was merged, and Wireshark credited **Nguyen Huu Trung** with discovering the bug while noting that no public exploits were known at the time of disclosure.
Aug 21, 2026