Executive brief
Wireshark, a widely used network protocol analyzer, is vulnerable to a crash when processing specially crafted Z39.50 network traffic. An attacker could exploit this by sending a malicious packet or providing a deceptive capture file, causing the application to crash and disrupting network analysis operations. This issue primarily impacts the availability of the tool for security and network professionals.
Technical details
A heap-based buffer overflow exists in the Z39.50 MARC21 dissector within the `dissect_marc_record()` function in `packet-z3950.c`. The vulnerability is caused by a floor/ceil mismatch when calculating the number of directory entries; the code allocates memory based on a floor division of the directory length but iterates using a loop that effectively performs a ceiling operation. An attacker can trigger a 12-byte out-of-bounds write by providing a crafted `data_offset` value that is not a multiple of the entry size. This can be exploited via a live capture on TCP port 210 or by tricking a user into opening a malicious capture file, leading to memory corruption and an application crash.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.6, 4.4.0 to 4.4.16
Timeline
- 2026-07-08: advisory: NVD publication date