Loading story…
Wireshark disclosed CVE-2026-15165, a flaw in TLS Encrypted Client Hello (ECH) transcript reconstruction affecting versions 4.6.0 through 4.6.6. A specially crafted packet capture containing repeated ech_outer_extensions entries can trigger a heap-based buffer overflow when Wireshark or tshark decrypts and processes the embedded TLS data, causing the application to crash when the capture is opened.
The proof of concept uses a Decryption Secrets Block in the capture to provide the HPKE secret needed to decrypt and validate the malicious inner ClientHello, removing the need for separate victim-side decryption configuration. The reported overflow can write attacker-controlled data beyond the allocated buffer and may present memory-corruption and potential code-execution risk, although Wireshark said no exploitation is known. Wireshark fixed the issue in version 4.6.7; organizations should upgrade analysis workstations and automated tshark processing environments.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Wireshark issued advisory WNPA-SEC-2026-56 for CVE-2026-15165, affecting versions 4.6.0 through 4.6.6, in which a malicious packet trace could crash the application during TLS ECH decryption. Version 4.6.7 fixed the issue; Wireshark said it was unaware of exploitation in the wild.
Anthropic's Claude and Ada Logics researcher David Korczynski reported that repeated ECH outer-extension entries in a crafted PCAPNG could overflow Wireshark's TLS transcript buffer. The capture could embed a Decryption Secrets Block to supply the HPKE secret, allowing the malicious inner ClientHello to be decrypted and processed when opened.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
gitlab.com
Open sourcewireshark.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Wireshark disclosed **CVE-2026-5653**, a heap-based buffer overflow in its DCP-ETSI protocol dissector that can crash the network protocol analyzer and cause a denial of service. The flaw affects Wireshark versions `4.6.0` through `4.6.4` and `4.4.0` through `4.4.14`, and was assigned **CWE-122** with a **CVSS v3.1 score of 5.5**. According to the advisory, an attacker could trigger the issue by injecting a malformed packet onto the network or by convincing a user to open a crafted packet capture file. Wireshark fixed the vulnerability in versions `4.6.5` and `4.4.15`; the issue was discovered by Alexandre de Oliveira, and the vendor said no active exploits were known at the time of disclosure.
Aug 21, 2026
Wireshark disclosed and patched a high-severity vulnerability in its C12.22 protocol dissector that can crash the application when processing malformed traffic or packet captures. The flaw, tracked as **CVE-2026-76886** and covered by advisory **`wnpa-sec-2026-75`**, stems from the EAX/CMAC decryption path, where `Eax_Decrypt()` accepts 32-bit lengths but passes them into 16-bit CMAC helper logic, causing integer truncation, undersized heap allocation, and subsequent oversized `memcpy()` operations that lead to a heap-buffer overflow. The vulnerable code path is reachable through reassembled C12.22 traffic over **TCP/1153** when **`c1222.decrypt`** is enabled and a matching decryption-table entry exists; researchers reported that a crafted **65,576-byte** MESSAGE can reliably trigger the crash. Wireshark said affected versions are **4.6.0 through 4.6.7** and **4.4.0 through 4.4.17**, with fixes released in **4.6.8** and **4.4.18** that reject oversized CMAC inputs before allocation. The issue was reported by researchers from **Aisle Research, O2Lab, and TAMU**, and Wireshark said no active exploits are known.
Aug 21, 2026
Wireshark disclosed a vulnerability in its Tektronix K12xx/`.rf5` file parser that can crash the packet analyzer when a user opens a specially crafted capture file. The issue, tracked as **CVE-2026-76885** and **wnpa-sec-2026-71**, stems from incorrect handling of skipped 16-byte blobs in `get_record()`, which can inflate the reported record length and lead downstream functions such as `k12_read()`, `k12_seek_read()`, and `process_packet_data()` to read past a heap buffer boundary. The bug was reported by Jaime Cavero and reproduced with AddressSanitizer in both `tshark` and `capinfos` using a synthetic malicious `.rf5` sample. Wireshark said the flaw affects versions **4.6.0 through 4.6.7** and **4.4.0 through 4.4.17**, and was fixed in **4.6.8** and **4.4.18** through merged K12 buffer-overrun patches; the project said no active exploits are known, but warned that an attacker could trigger a denial of service by convincing a target to open a malformed capture file.
Aug 21, 2026