Executive brief
Wireshark is a widely-used network traffic analysis tool for inspecting packet data. On Windows systems built with MSVC or Intel compilers, a bug in the packet writing helper function causes it to write 4 bytes instead of the intended 2 bytes, corrupting adjacent memory. An attacker can exploit this via a malformed network capture file (like VWR or NetMon format) to crash Wireshark or potentially execute code on systems processing untrusted packet captures.
Technical details
The vulnerability is an out-of-bounds write (CWE-787) in the optimized MSVC/Intel implementation of the `phtoleu16()` helper function in `wsutil/pint.h`. The function is documented and used as a 2-byte little-endian store but uses a 32-bit parameter and calls `memcpy(p, &v, sizeof(v))` which copies 4 bytes. The bug affects only MSVC without clang-cl, Intel Classic, or Intel LLVM builds; GCC/Clang portable implementations are unaffected. Attack vectors include parsing malformed VWR S3 WLAN RF capture files and NetMon format exports; callers also include RTP audio export functionality. The overflow is deterministic on affected builds and can corrupt stack or heap-allocated 2-byte objects. A patch changing the parameter to `uint16_t` and using `sizeof(v)` correctly fixes the issue. Wireshark 4.6.8 or later resolves this.
Affected products
- Wireshark Wireshark 4.6.0 to 4.6.7
Timeline
- 2026-08-12: disclosed
- 2026-08-13: patched: Fix released in Wireshark 4.6.8