Executive brief
Wireshark is a widely-used network packet analysis tool that security teams and network engineers rely on to inspect and troubleshoot network traffic. A flaw in its UMTS RRC protocol dissector can crash Wireshark when processing specially crafted packets, potentially injected into a network or delivered via a malformed packet capture file. This could disrupt security monitoring and incident response activities.
Technical details
The UMTS RRC dissector in Wireshark contains a heap corruption vulnerability in how it handles RB-Identity values from protocol-valid packets. The dissector stores an RB-Identity value in private RRC state and later uses it directly as an array index into rrc_ciphering_info.seq_no, which has a smaller first dimension than the ASN.1 range allows. This out-of-bounds array indexing corrupts adjacent heap-allocated fields during packet dissection, leading to a crash. The vulnerability requires no authentication and can be triggered either through malformed network packets or by opening a crafted packet capture file. Patches are available in Wireshark 4.6.8 and 4.4.18.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.7, 4.4.0 to 4.4.17
Timeline
- 2026-08-12: disclosed
- 2026-08-19: advisory: Security advisory wnpa-sec-2026-88 published
- 2026: patched: Fixed in versions 4.6.8 and 4.4.18