Executive brief
Wireshark is a widely-used network analysis tool that decodes and displays packet data. The C12.22 protocol dissector component contains a buffer overflow flaw that allows an attacker to crash the application by sending a specially crafted network packet or providing a malformed packet capture file. This denial-of-service attack could interrupt incident investigation, threat analysis, and network troubleshooting activities.
Technical details
The vulnerability is a stack buffer overflow in the C12.22 protocol dissector's `canonify_unencrypted_header()` function. The function reconstructs a BER tag and length in a fixed 300-byte stack buffer before validating that sufficient space remains; packet-controlled header elements can exhaust the buffer, causing subsequent writes to overflow. The overflow occurs in `decrypt_packet()` at packet-c1222.c:908 when processing C12.22 packets on TCP/UDP port 1153. No authentication, valid cryptographic key, or MAC verification is required—the bounds check that could prevent corruption is performed after the write. The attack is triggered via network delivery or malicious PCAP files, resulting in process abort and denial of service.
Affected products
- Wireshark Foundation Wireshark 4.4.0 to 4.4.17, 4.6.0 to 4.6.7
Timeline
- 2026-08-12: disclosed
- 2026-08-19: patched: Wireshark 4.6.8, 4.4.18