Is CVE-2026-5402 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5402 being exploited in the wild.

How severe is CVE-2026-5402?

High severity, with a CVSS score of 8.8, published 30 April 2026.

Which products and versions are affected?

Wireshark Foundation Wireshark 4.6.0 to 4.6.4.

Is there a fix for CVE-2026-5402?

A patch was published on 2026-04-30: Wireshark 4.6.5 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5402 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5402?

Check whether you run Wireshark. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5402: Wireshark TLS protocol dissector heap overflow

CVE-2026-5402 · Severity: high · CVSS 8.8 · Published 2026-04-30

Wireshark, a widely used network protocol analyzer, is vulnerable to a flaw in how it processes encrypted web traffic (TLS). An attacker can exploit this by sending a malicious network packet or tricking a user into opening a specially crafted capture file. This could lead to the application crashing or, in some cases, allow the attacker to execute unauthorized code on the user's system.

Technologies: Wireshark. Vendors: Wireshark.

Quick answers

Is CVE-2026-5402 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5402 being exploited in the wild.
How severe is CVE-2026-5402?: High severity, with a CVSS score of 8.8, published 30 April 2026.
Which products and versions are affected?: Wireshark Foundation Wireshark 4.6.0 to 4.6.4.
Is there a fix for CVE-2026-5402?: A patch was published on 2026-04-30: Wireshark 4.6.5 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5402 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5402?: Check whether you run Wireshark. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in Wireshark's TLS Encrypted Client Hello (ECH) transcript reconstruction code. The vulnerability is caused by integer truncation and unsigned underflow issues during the processing of 'ech_outer_extensions'. Specifically, truncation in the extensions loop allows an attacker to write controlled data past the bounds of a heap-allocated buffer. An attacker can trigger this by injecting a malformed TLS ClientHello packet into live traffic being captured or by providing a crafted .pcapng file for analysis. This can result in a crash (DoS) or arbitrary code execution. The issue is resolved in Wireshark version 4.6.5.

Affected products

Wireshark Foundation Wireshark 4.6.0 to 4.6.4

Timeline

2026-04-29: advisory: Wireshark published wnpa-sec-2026-14
2026-04-30: disclosed: CVE-2026-5402 published to NVD
2026-04-30: patched: Wireshark 4.6.5 released to address the issue

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.