Loading story…
Wireshark disclosed and fixed CVE-2026-15170, a heap-buffer-overflow flaw in the Z39.50 MARC21 dissector's dissect_marc_record() function in packet-z3950.c. The bug was caused by a floor/ceil mismatch when calculating MARC directory entries: the code allocated a heap array based on floor division of the directory length by 12 bytes, but under attacker-controlled conditions could iterate one extra time and perform a 12-byte out-of-bounds heap write. The resulting memory corruption could crash Wireshark or tshark when processing a crafted packet capture or a malicious Z39.50 response on TCP port 210.
The issue affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16, and was fixed in 4.6.7 and 4.4.17 under advisory wnpa-sec-2026-58. Wireshark said an attacker could trigger the flaw by injecting a malformed packet onto the network or by convincing a user to open a malicious trace file. The vulnerability was reproduced with Wireshark's fuzzshark harness and confirmed with AddressSanitizer, and the project said it was discovered by Claude and Ada Logics; no active exploits were known at disclosure.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Wireshark published security advisory wnpa-sec-2026-58 for CVE-2026-15170, describing a Z39.50 dissector crash affecting versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. The advisory said the issue was fixed in versions 4.6.7 and 4.4.17 and recommended users upgrade.
A heap-buffer-overflow vulnerability in Wireshark's Z39.50 MARC21 dissector was reported in issue 21397, affecting the `dissect_marc_record()` function and enabling memory corruption or a crash via crafted traffic or capture files. The report included technical reproduction details, noted the issue was found by Anthropic using Claude and manually reviewed by Ada Logics, and proposed fixes for the parsing logic.
Wireshark later closed the GitLab issue after merging fixes, with John Thacker closing it via commit `c9bd4982`. Gerald Combs stated that the vulnerability had been assigned CVE-2026-15170.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
wireshark.org
Open sourcegitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed and patched a high-severity vulnerability in its C12.22 protocol dissector that can crash the application when processing malformed traffic or packet captures. The flaw, tracked as **CVE-2026-76886** and covered by advisory **`wnpa-sec-2026-75`**, stems from the EAX/CMAC decryption path, where `Eax_Decrypt()` accepts 32-bit lengths but passes them into 16-bit CMAC helper logic, causing integer truncation, undersized heap allocation, and subsequent oversized `memcpy()` operations that lead to a heap-buffer overflow. The vulnerable code path is reachable through reassembled C12.22 traffic over **TCP/1153** when **`c1222.decrypt`** is enabled and a matching decryption-table entry exists; researchers reported that a crafted **65,576-byte** MESSAGE can reliably trigger the crash. Wireshark said affected versions are **4.6.0 through 4.6.7** and **4.4.0 through 4.4.17**, with fixes released in **4.6.8** and **4.4.18** that reject oversized CMAC inputs before allocation. The issue was reported by researchers from **Aisle Research, O2Lab, and TAMU**, and Wireshark said no active exploits are known.
Aug 21, 2026
Wireshark disclosed and fixed a vulnerability in its UMTS RRC protocol dissector that could corrupt heap memory and crash the application during packet dissection. The flaw, assigned **`CVE-2026-76880`**, stemmed from a protocol-valid, packet-controlled `RB-Identity` value being stored in private state and later used directly as an array index, allowing writes beyond the intended bounds of `rrc_ciphering_info.seq_no` and corruption of adjacent heap-allocated ciphering state. According to Wireshark's security advisory **`wnpa-sec-2026-88`**, the issue affects versions **4.6.0 through 4.6.7** and **4.4.0 through 4.4.17**, and was fixed in **4.6.8** and **4.4.18**. An attacker could trigger the bug by injecting a malformed packet onto the network or by convincing a user to open a crafted packet capture file; Wireshark said no active exploits were known at the time of disclosure, and the underlying fix was tracked in the project's GitLab issue and resolved with commit **`a44c8dc0`**.
Aug 21, 2026
Wireshark disclosed **CVE-2026-5653**, a heap-based buffer overflow in its DCP-ETSI protocol dissector that can crash the network protocol analyzer and cause a denial of service. The flaw affects Wireshark versions `4.6.0` through `4.6.4` and `4.4.0` through `4.4.14`, and was assigned **CWE-122** with a **CVSS v3.1 score of 5.5**. According to the advisory, an attacker could trigger the issue by injecting a malformed packet onto the network or by convincing a user to open a crafted packet capture file. Wireshark fixed the vulnerability in versions `4.6.5` and `4.4.15`; the issue was discovered by Alexandre de Oliveira, and the vendor said no active exploits were known at the time of disclosure.
Aug 21, 2026