Executive brief
Wireshark is a widely used network protocol analyzer that allows users to examine data from a live network or from a capture file. A vulnerability in its DBS Etherwatch file parser allows a specially crafted capture file to crash the application. This can lead to a denial of service, preventing security professionals from analyzing network traffic or causing automated capture-processing services to fail.
Technical details
A heap-based buffer overflow exists in the DBS Etherwatch capture file parser (wiretap/dbs-etherwatch.c) within Wireshark. The vulnerability occurs because the reader writes bytes into a record buffer while parsing hex dumps without verifying the write remains within the allocated memory bounds; length checks are only performed after a full line is processed. An attacker can exploit this by providing a malicious capture file, which the application may auto-detect and process without user interaction or authentication. While the primary reported impact is a denial of service (crash), the ability to control the overflow content and length suggests potential for memory corruption. The issue is addressed in Wireshark versions 4.6.7 and 4.4.17.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.6, 4.4.0 to 4.4.16
Timeline
- 2026-07-08: disclosed
- 2026-07-08: advisory