Executive brief
Wireshark, a widely used network protocol analyzer, is vulnerable to a crash when processing specifically crafted capture files. An attacker can create a malicious file that, when opened by a user, causes the application to shut down unexpectedly. This results in a denial of service, preventing security teams or administrators from analyzing network traffic using the affected software.
Technical details
A NULL pointer dereference exists in the SSH protocol dissector within the `ssh_keylog_process_line()` function. The vulnerability is triggered when Wireshark processes a pcapng Decryption Secrets Block (DSB) containing malformed SSH key-log metadata, such as empty or excessively long hex tokens. When `ssh_kex_make_bignum()` returns NULL due to these invalid lengths, the application fails to validate the return value before dereferencing it to access the 'length' field. This is a metadata processing issue rather than a network packet issue; an attacker must convince a user to open a crafted capture file. The flaw affects Wireshark GUI, tshark, and sharkd. Versions 4.6.7 and 4.4.17 are expected to contain the fix.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.6, 4.4.0 to 4.4.16
Timeline
- 2026-07-08: disclosed: Initial publication of CVE-2026-15171
- 2026-07-08: advisory