# CVE-2026-15164: Wireshark ciscodump heap buffer overflow in hex-dump parsers

Source: https://junglewise.ai/threats/cve-2026-15164-wireshark-ciscodump-heap-buffer-overflow-in-hex-dump-parsers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-15164 · Severity: medium · CVSS 5.5 · Published 2026-07-08

A vulnerability exists in ciscodump, a tool included with Wireshark used to capture network traffic from Cisco devices. If a user connects the tool to a malicious or compromised Cisco device, the device can send specially crafted data that causes the tool to crash. This results in a denial of service, preventing the user from successfully capturing or analyzing network traffic from that source.

Vendors: [Wireshark Foundation](https://junglewise.ai/threats/vendors/wireshark-foundation).

## Quick answers

**Is CVE-2026-15164 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15164 being exploited in the wild.

**How severe is CVE-2026-15164?** Medium severity, with a CVSS score of 5.5, published 8 July 2026.

**Which products and versions are affected?** Wireshark Foundation Ciscodump 4.6.0 to 4.6.6, 4.4.0 to 4.4.16.

**Is there a fix for CVE-2026-15164?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15164 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15164?** Check whether you run Wireshark Foundation Ciscodump at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A heap-based buffer overflow (CWE-122) exists in the ciscodump extcap capture tool's remote hex-dump parsers. The tool allocates a fixed 65,535-byte heap buffer (PACKET_MAX_SIZE) but fails to perform bounds checking when appending decoded hex groups via memcpy in the parse_line_ios, parse_line_ios_xe_16, parse_line_ios_xe_17, and parse_line_asa functions. An attacker controlling a remote Cisco device or performing a Man-in-the-Middle attack on the SSH session can stream more than 65,535 bytes of hex data for a single packet, leading to an out-of-bounds write. This results in a crash (DoS) and potentially arbitrary code execution. The issue is addressed in versions 4.6.7 and 4.4.17.

## Affected products

- Wireshark Foundation ciscodump 4.6.0 to 4.6.6, 4.4.0 to 4.4.16

## Timeline

- 2026-06-22: other: Vulnerability verified on master branch
- 2026-07-08: disclosed: Initial disclosure date
- 2026-07-08: advisory: NVD publication date

## References

- [https://gitlab.com/wireshark/wireshark/-/work_items/21375](https://gitlab.com/wireshark/wireshark/-/work_items/21375)
- [https://www.wireshark.org/security/wnpa-sec-2026-63.html](https://www.wireshark.org/security/wnpa-sec-2026-63.html)