Is CVE-2026-5403 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5403 being exploited in the wild.

How severe is CVE-2026-5403?

High severity, with a CVSS score of 7.8, published 1 May 2026.

Which products and versions are affected?

Wireshark Foundation Wireshark 4.6.0 to 4.6.4, 4.4.0 to 4.4.14; Red Hat Red Hat Enterprise Linux 10 All versions.

Is there a fix for CVE-2026-5403?

A patch was published on 2026-06-30: Red Hat updated VEX documentation for REL 10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5403 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-5403?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5403: Wireshark heap buffer overflow in SBC audio codec

CVE-2026-5403 · Severity: high · CVSS 7.8 · Published 2026-05-01

Wireshark, a widely used network protocol analyzer, is vulnerable to a memory corruption issue when processing certain audio data. An attacker could exploit this by tricking a user into opening a specially crafted network capture file, potentially causing the application to crash or allowing the attacker to take control of the system. This affects users who have the SBC audio codec installed and use Wireshark to analyze Bluetooth or multimedia traffic.

Quick answers

Is CVE-2026-5403 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5403 being exploited in the wild.
How severe is CVE-2026-5403?: High severity, with a CVSS score of 7.8, published 1 May 2026.
Which products and versions are affected?: Wireshark Foundation Wireshark 4.6.0 to 4.6.4, 4.4.0 to 4.4.14; Red Hat Red Hat Enterprise Linux 10 All versions.
Is there a fix for CVE-2026-5403?: A patch was published on 2026-06-30: Red Hat updated VEX documentation for REL 10 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5403 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-5403?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in the codec_sbc_decode() function within plugins/codecs/sbc/sbc.c. The vulnerability is caused by a failure to decrement remaining-space counters (size_in and size_out) during a multi-frame decode loop, leading to an out-of-bounds write when an RTP packet contains more than approximately 256 SBC frames. An attacker can trigger this by providing a crafted pcapng file containing malformed RTP payloads. The exploit requires the SBC codec plugin to be compiled with libsbc; systems without this library are unaffected. Successful exploitation can result in application crashes (DoS) or arbitrary code execution under the context of the user running Wireshark or sharkd.

Affected products

Wireshark Foundation Wireshark 4.6.0 to 4.6.4, 4.4.0 to 4.4.14
Red Hat Red Hat Enterprise Linux 10 All versions

Timeline

2026-04-29: advisory: Wireshark published security advisory wnpa-sec-2026-16
2026-04-30: disclosed: Initial CVE publication date
2026-05-01: other: Red Hat bug report created
2026-06-30: patched: Red Hat updated VEX documentation for REL 10

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.