Loading story…
Wireshark fixed CVE-2026-3202, a denial-of-service flaw in its NTS-KE protocol dissector that can crash Wireshark or Tshark when processing malformed NTS-KE network traffic or crafted packet-capture files. The vulnerability affects Wireshark versions 4.6.0 through 4.6.3; Wireshark reported no known exploitation in the wild.
The defect was discovered by ASan Menagerie fuzzing, which triggered a null-pointer read in strcmp from dissect_nts_ke while Tshark analyzed TLS-carried NTS-KE traffic. The remediation adds a presence check for the ALPN string before comparison; it was merged in merge request !23512 and commit 5fdfc578. Organizations using affected releases should upgrade to Wireshark 4.6.4 or later.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Wireshark published advisory wnpa-sec-2026-06 for CVE-2026-3202, a denial-of-service flaw affecting versions 4.6.0 through 4.6.3. Malformed NTS-KE network traffic or packet-trace files could crash Wireshark; version 4.6.4 resolves the issue, and Wireshark reported no known exploitation.
Wireshark's ASan Menagerie fuzzing job detected a null-pointer read crash in the NTS-KE dissector while processing a malformed capture file. The crash reached strcmp from dissect_nts_ke while Tshark processed TLS-carried NTS-KE traffic.
Wireshark corrected the NTS-KE dissector to verify that an ALPN string is present before calling strcmp. The fix was merged in merge request !23512 and the issue was closed with commit 5fdfc578.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Wireshark Foundation released **Wireshark 4.6.4**, a maintenance update that patches multiple security flaws in protocol dissectors that could be triggered by malformed or edge-case traffic to cause **denial-of-service conditions** (e.g., crashes, infinite loops, or resource exhaustion) during packet analysis. Reported fixes include issues leading to **memory exhaustion** in the USB HID dissector and crash conditions affecting dissectors such as **NTS-KE** and **RF4CE**, reducing the risk that crafted captures or live traffic could disrupt analyst workflows or automated inspection pipelines. Wireshark 4.6.4 also addresses additional dissector stability problems, including a **crash in the HTTP3 dissector** and an **infinite loop in the MEGACO dissector**, and it resolves a **plugin compatibility** regression introduced by an API/ABI change in 4.6.1 that impacted plugins built for 4.6.0. Beyond security-related fixes, the release includes stability and performance improvements (including an “Expert Info” performance issue and various capture-file and toolchain fixes affecting utilities like *TShark* and *editcap*), supporting more reliable operation in enterprise monitoring, incident response, and malware analysis environments.
Jun 29, 2026
Wireshark disclosed **CVE-2025-13499**, a denial-of-service flaw in its Kafka dissector that can crash the application when it processes malformed network traffic or a specially crafted packet capture file. The issue affects Wireshark `4.6.0` and `4.4.0` through `4.4.10`, and the project said no active exploits were known at disclosure. Users were advised to upgrade to **Wireshark 4.6.1, 4.4.11, or later**. Project details show the bug was uncovered by an internal fuzzing job on the `release-4.4` branch after `tshark` processed a crafted `.pcap` file and hit an assertion failure in `epan/tvbuff.c`. Developers traced the crash to Kafka Snappy decompression logic handling Xerial framing: when the length equaled `16`, the code returned success without initializing the decompressed `tvbuff` pointer, leaving `composite_tvb` unset and causing the crash. Wireshark fixed the flaw in merge request `!22037` and commit `49137f8c`.
Aug 21, 2026
Wireshark disclosed a high-severity flaw in its Kerberos protocol dissector that can crash **Wireshark** or **TShark** when processing malformed traffic or packet captures. The bug, tracked as `CVE-2026-76924` and documented in advisory `wnpa-sec-2026-78`, stems from an out-of-bounds read while formatting a preview of a learned `EncryptionKey` from plaintext Kerberos credential data. Researchers reported that a crafted `EncKrbCredPart`, including traffic delivered over UDP/88, could trigger a heap-buffer-overflow even without a valid keytab, valid key, or successful decryption. The vendor said the issue affects Wireshark versions **4.6.0 through 4.6.7** and **4.4.0 through 4.4.17**, and it has been fixed in **4.6.8** and **4.4.18**. The root cause was that the dissector copied bounded key bytes into retained storage but still read four bytes from the original input buffer, allowing one- to three-byte keys to cause the crash; the fix reformats the preview from a zero-initialized retained buffer after the bounded copy. Wireshark said malformed packets injected onto a network or malicious packet capture files could trigger the vulnerability, and no active exploits are known.
Aug 21, 2026