Executive brief
Wireshark, a widely used network protocol analyzer, is vulnerable to a crash when processing specifically crafted wireless network traffic. An attacker could provide a malicious capture file that, when opened by a user, causes the application to crash or potentially allows for unauthorized code execution. This impact disrupts the ability of security teams to analyze network traffic and could be used as a stepping stone for further system compromise.
Technical details
A stack-based buffer overflow (CWE-121) exists in the `Dot11DecryptDecryptKeyData()` function within `epan/crypt/dot11decrypt.c`. The vulnerability is triggered when Wireshark attempts to decrypt an EAPOL-Key frame's Key Data into a fixed 1024-byte stack buffer (`decrypted_data`). The copy length is derived from attacker-controlled 16-bit EAPOL header fields and is not validated against the destination buffer size. An attacker can provide a crafted packet with a large `key_bytes_len` (e.g., ~2000 bytes), leading to stack corruption. Exploitation requires WPA decryption to be enabled and a valid Security Association to be established. The issue affects Wireshark versions 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16; it is addressed in versions 4.6.7 and 4.4.17.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.6, 4.4.0 to 4.4.16
Timeline
- 2026-07-08: disclosed: Vulnerability reported via GitLab and NVD
- 2026-07-08: advisory