Executive brief
Wireshark, a widely used network protocol analyzer, is vulnerable to a denial-of-service attack when processing certain network traffic. By tricking a user into opening a malicious capture file or by sending a specially crafted packet over a network being monitored, an attacker can cause the application to hang or crash. This results in the software becoming unresponsive and consuming excessive system resources, potentially disrupting network troubleshooting or security monitoring operations.
Technical details
An integer overflow vulnerability exists in the FMP/NOTIFY protocol dissector within the `dissect_handleList()` function. The vulnerability is caused by a lack of validation on the `numHandles` value and an unchecked input for a loop condition (CWE-606). Specifically, the `listLength` variable is a signed integer that can overflow or remain static when processing crafted RPC packets with malicious handle length values. This allows an attacker to trigger an infinite loop that consumes 100% CPU, causing both the Wireshark GUI and TShark CLI to hang indefinitely. The issue is fixed in versions 4.6.7 and 4.4.17.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.6, 4.4.0 to 4.4.16
Timeline
- 2026-07-08: disclosed
- 2026-07-08: advisory