Loading story…
Wireshark fixed CVE-2026-6526, a null-pointer dereference that allows a crafted RTSP packet or malicious capture file to crash Wireshark and TShark during protocol dissection. The flaw affects Wireshark versions 4.6.0 through 4.6.4 and is resolved in 4.6.5; Wireshark reported no known exploitation.
A malformed RTSP DESCRIBE request can cause HTTP Location target resolution to produce an empty base URL, after which unchecked use of strstr() results in a NULL+3 dereference in determine_http_location_target. The remediation validates the strstr() return value before it is incremented and dereferenced; related fixes were merged and backported, although maintainers said the supplied proof of concept does not affect the 4.4.x branch.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Wireshark published advisory wnpa-sec-2026-35 for CVE-2026-6526, a crash vulnerability affecting versions 4.6.0 through 4.6.4. It released version 4.6.5 as the fix, recommended upgrading, and stated it was unaware of exploitation; Alexandre de Oliveira was credited with discovery.
Wireshark resolved a NULL-pointer dereference in determine_http_location_target that crafted RTSP/SDP traffic or a capture file could trigger, crashing TShark or the Wireshark GUI. The fix added validation of the strstr() result before incrementing and dereferencing it, and was merged through merge request !24268 with related backports.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cve.mitre.org
Open sourcegitlab.com
Open sourcewireshark.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark fixed **CVE-2026-3202**, a denial-of-service flaw in its NTS-KE protocol dissector that can crash Wireshark or Tshark when processing malformed NTS-KE network traffic or crafted packet-capture files. The vulnerability affects Wireshark versions 4.6.0 through 4.6.3; Wireshark reported no known exploitation in the wild. The defect was discovered by ASan Menagerie fuzzing, which triggered a null-pointer read in `strcmp` from `dissect_nts_ke` while Tshark analyzed TLS-carried NTS-KE traffic. The remediation adds a presence check for the ALPN string before comparison; it was merged in merge request `!23512` and commit `5fdfc578`. Organizations using affected releases should upgrade to Wireshark 4.6.4 or later.
Sep 23, 2026
Wireshark disclosed **CVE-2026-6532**, a crash-causing flaw in the **Kismet protocol dissector** that can be triggered by a malformed packet on the network or by opening a crafted packet capture file. The issue affects Wireshark versions **4.6.0 through 4.6.4** and **4.4.0 through 4.4.14**, and has been fixed in **4.6.5** and **4.4.15**. Wireshark said no exploits are known and credited **Sharon Brizinov** with discovering the vulnerability. A related fuzzing report showed a **heap-buffer-overflow** in `tshark` while processing a crafted capture, with the crash occurring in `format_text_internal` and being reached through `packet-kismet.c` during packet dissection. The bug was reproduced in Wireshark's CI fuzzing environment on Ubuntu 24.04.4 LTS, and the original crash report was later marked as a duplicate of a dedicated Kismet dissector issue and explicitly assigned **CVE-2026-6532**.
Aug 21, 2026
Wireshark disclosed and fixed memory-safety flaws in its UMTS FP dissector that could be triggered by malformed network traffic or crafted packet capture files opened in **Wireshark**, `tshark`, or `sharkd`. One issue, tracked as **CVE-2026-15169** and published as **wnpa-sec-2026-59**, stems from `dissect_e_dch_t2_or_common_channel_info()` writing past a static `subframes[16]` array in the UMTS FP E-DCH Type-2 parser, enabling memory corruption and at minimum a reliable denial of service. Wireshark said the bug affects versions **4.6.0 through 4.6.6** and **4.4.0 through 4.4.16**, and was fixed in **4.6.7** and **4.4.17**. A related flaw in the same function was later assigned **CVE-2026-76889** after researchers showed that a packet-controlled continuation flag could keep MAC-is descriptor parsing running beyond 16 entries, causing fixed-array out-of-bounds writes to `mac_is_lchid[pdu_no][16]` and `mac_is_length[pdu_no][16]`. The bugs were reproduced with sanitizers against development and pre-release builds, and Wireshark closed the reports after merging fixes including **!25692** for UMTS-FP limits checking and **!25780** for the MAC-is descriptor handling issue. The disclosures indicate the vulnerabilities could be exploited through injected malformed packets or malicious trace files, although no public exploits were reported at disclosure time.
Aug 21, 2026