Loading story…
Wireshark fixed a denial-of-service vulnerability in its Robust Header Compression (ROHC) protocol dissector. Specially crafted ROHC traffic injected onto a monitored network, or a malicious packet-capture file opened by an analyst, could crash the application. The flaw affects Wireshark versions 4.6.0 through 4.6.5 and 4.4.0 through 4.4.15; fixes are available in 4.6.6 and 4.4.16.
The underlying defect involved the ROHC uncompressed profile with a large context identifier (CID). A packet ending at the CID field could trigger a zero-length allocation that returned NULL, followed by a one-byte write to that pointer; subsequent length handling could also underflow into an effectively SIZE_MAX copy request. Exploitation requires a multi-packet sequence to establish ROHC context, commonly in GTP-U or PPP traffic. Wireshark reported no known exploitation in the wild.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
A GitLab issue documented a NULL write and potential heap-corruption condition in Wireshark's ROHC dissector when processing an uncompressed profile with large CID. The flaw required a multi-packet sequence to establish the affected ROHC context and was reported by Arjun Basnet of Securin Labs.
Wireshark published advisory wnpa-sec-2026-51 for a malformed-packet crash vulnerability in the ROHC dissector, affecting versions 4.6.0–4.6.5 and 4.4.0–4.4.15. Fixes were released in versions 4.6.6 and 4.4.16; Wireshark said it was unaware of exploitation in the wild.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed and fixed a vulnerability in its UMTS RRC protocol dissector that could corrupt heap memory and crash the application during packet dissection. The flaw, assigned **`CVE-2026-76880`**, stemmed from a protocol-valid, packet-controlled `RB-Identity` value being stored in private state and later used directly as an array index, allowing writes beyond the intended bounds of `rrc_ciphering_info.seq_no` and corruption of adjacent heap-allocated ciphering state. According to Wireshark's security advisory **`wnpa-sec-2026-88`**, the issue affects versions **4.6.0 through 4.6.7** and **4.4.0 through 4.4.17**, and was fixed in **4.6.8** and **4.4.18**. An attacker could trigger the bug by injecting a malformed packet onto the network or by convincing a user to open a crafted packet capture file; Wireshark said no active exploits were known at the time of disclosure, and the underlying fix was tracked in the project's GitLab issue and resolved with commit **`a44c8dc0`**.
Aug 21, 2026
Wireshark disclosed **CVE-2025-1492**, a denial-of-service flaw that can crash the application through its Bundle Protocol and CBOR dissectors. The issue, identified through OSS-Fuzz, affects Wireshark versions `4.4.0`–`4.4.3` and `4.2.0`–`4.2.10`; related fuzzing identified a stack-overflow condition while processing UDP protocol input. An attacker could trigger the crash by injecting a malformed packet onto a monitored network or by convincing a user to open a crafted packet-capture file. Wireshark reported no known exploitation and released fixes in versions `4.4.4` and `4.2.11`; organizations should upgrade affected installations or later versions.
Sep 23, 2026
The Wireshark Foundation released **Wireshark 4.6.4**, a maintenance update that patches multiple security flaws in protocol dissectors that could be triggered by malformed or edge-case traffic to cause **denial-of-service conditions** (e.g., crashes, infinite loops, or resource exhaustion) during packet analysis. Reported fixes include issues leading to **memory exhaustion** in the USB HID dissector and crash conditions affecting dissectors such as **NTS-KE** and **RF4CE**, reducing the risk that crafted captures or live traffic could disrupt analyst workflows or automated inspection pipelines. Wireshark 4.6.4 also addresses additional dissector stability problems, including a **crash in the HTTP3 dissector** and an **infinite loop in the MEGACO dissector**, and it resolves a **plugin compatibility** regression introduced by an API/ABI change in 4.6.1 that impacted plugins built for 4.6.0. Beyond security-related fixes, the release includes stability and performance improvements (including an “Expert Info” performance issue and various capture-file and toolchain fixes affecting utilities like *TShark* and *editcap*), supporting more reliable operation in enterprise monitoring, incident response, and malware analysis environments.
Jun 29, 2026