Executive brief
Wireshark, a widely used network protocol analyzer, is vulnerable to a crash when processing specially crafted network traffic captures. An attacker can create a malicious capture file that, when opened by a user, causes the application to crash or potentially allows for further system compromise. This impact disrupts the ability of security teams to analyze network traffic and could be used as a foothold for more complex attacks.
Technical details
A heap-based buffer overflow exists in the TLS ECH decryptor within `packet-tls-utils.c`. The vulnerability is rooted in the `ssl_dissect_hnd_hello_ext_ech()` function, which allocates a transcript buffer based on the size of the outer ClientHello but fails to enforce destination bounds checks or the RFC-mandated limit of one `ech_outer_extensions` entry during reconstruction. An attacker can trigger the overflow by including multiple `0xfd00` extension entries that reference large outer extensions, leading to a large attacker-controlled heap write. Exploitation requires the victim to open a crafted pcapng file containing a Decryption Secrets Block (DSB). While primarily identified as a denial of service (crash), the nature of the heap overflow suggests potential for remote code execution. Fixed in version 4.6.7.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.6
Timeline
- 2026-07-08: disclosed
- 2026-07-08: advisory