Executive brief
Wireshark, a widely used network protocol analyzer, is vulnerable to a crash when processing specially crafted UMTS FP network traffic. An attacker can exploit this by providing a malicious capture file to a user; when the file is opened, it causes the application to crash. This results in a denial of service, preventing security teams or network administrators from analyzing network data.
Technical details
A heap-based buffer overflow (CWE-122) exists in the UMTS FP protocol dissector, specifically within the `dissect_e_dch_t2_or_common_channel_info()` function. The vulnerability is caused by an out-of-bounds write to a static array `subframes[16]`. A crafted packet can manipulate the 'F' flag in a MAC-is SDU descriptor chain to increment an index beyond the fixed array bounds of 16. While the dissector emits an expert-info warning when the expected count is exceeded, it fails to break the loop, leading to memory corruption. This can be triggered by opening a malicious Catapult DCT2000 or UMTS-FP capture file in Wireshark, TShark, or sharkd. Patches are available in Wireshark versions 4.6.7 and 4.4.17.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.6, 4.4.0 to 4.4.16
Timeline
- 2026-06-30: other: Vulnerability discovered and PoC generated by Anthropic/Ada Logics.
- 2026-07-08: disclosed: CVE-2026-15169 published.