The Wireshark project has released version 4.4.6 addressing CVE-2026-5656, a code execution vulnerability in the PCAP and PCAPNG file parsing subsystem. A specially crafted network capture file can trigger a heap buffer overflow during the dissector initialisation phase, which a skilled attacker can leverage to achieve arbitrary code execution on the analyst’s workstation.
Vulnerability Details
CVE-2026-5656 resides in Wireshark’s core file parser — specifically in the code path that processes per-packet dissector state during PCAP/PCAPNG file loading, before any protocol dissection begins. A malicious capture file with crafted packet record headers can trigger an integer overflow in a buffer size calculation, resulting in an undersized heap allocation followed by an out-of-bounds write.
The vulnerability affects:
- Wireshark for Windows (all supported versions prior to 4.4.6)
- Wireshark for macOS (all supported versions prior to 4.4.6)
- Wireshark for Linux (all supported versions prior to 4.4.6)
- TShark (Wireshark’s command-line analysis tool) — same codebase, same vulnerability
The CVSS score is 7.8 (HIGH) with a local attack vector — the vulnerability requires a user to open a malicious file, rather than being exploitable over the network directly. However, in the context of security operations, this distinction is less protective than it sounds.
Attack Vector in Security Operations Contexts
For general users, a PCAP file from an untrusted source is an unusual risk scenario. For security analysts, it is routine:
- Incident response: Analysts frequently receive network capture files from client environments, third-party forensic firms, or network monitoring appliances during investigations — files sourced from networks that may already be compromised
- Threat hunting: SOC analysts open capture files from SIEM exports, IDS/IPS systems, and packet broker appliances to investigate alerts
- Malware analysis: Malware analysts capture network traffic from dynamic sandbox environments and open captures to analyse command-and-control communications
- CTF and training exercises: Capture files from CTF competitions and training labs are routinely shared and opened — a malicious file embedded in a CTF archive would reach a highly technical audience with Wireshark installed
In each of these contexts, an analyst who opens a PCAP file from an external or potentially adversary-controlled source is within the threat model for CVE-2026-5656.
The practical implication: a threat actor who can influence a capture file that an analyst will open — by deploying malware that captures and exfiltrates modified PCAPs, or by providing a malicious capture file during a simulated incident scenario — can pivot from the investigated environment to the analyst’s workstation.
Remediation
Update Wireshark to version 4.4.6, available from wireshark.org. The update addresses CVE-2026-5656 and an additional two lower-severity denial-of-service vulnerabilities in protocol dissectors.
For enterprise deployments: Wireshark is frequently installed on analyst workstations, forensic laptops, and dedicated network analysis hosts without central software management. Identify all Wireshark installations in your environment — including TShark installations on servers and network appliances — and apply the update.
For Linux systems: Wireshark packages in major distribution repositories (Debian, Ubuntu, RHEL/CentOS, Fedora) will typically be updated within days of the upstream release. Check wireshark --version and update via your package manager.
Interim mitigation: If immediate patching is not possible, restrict who can provide PCAP files for analysis. Capture files from external or untrusted sources should be opened in an isolated analysis environment (VM or dedicated forensic workstation) rather than on production analyst machines with internal network access.
This is not the first code execution vulnerability in Wireshark’s file parsers — the project has an established disclosure and patch history for parser bugs. Wireshark’s broad installation base and routine use with externally-sourced files makes parser vulnerabilities consistently worthy of immediate patching.
Share this article