Executive brief
Wireshark is a widely-used network packet capture and analysis tool. A flaw in the Catapult DCT2000 file parser allows an attacker to crash Wireshark by providing a malformed capture file, potentially disrupting network diagnostics and incident investigations. An attacker could weaponize this to prevent analysis of network traffic during a security incident or in corporate security operations centers.
Technical details
The vulnerability is a heap out-of-bounds write in the Catapult DCT2000 wiretap file parser (wiretap/catapult_dct2000.c:1382). The root cause is an off-by-one error where floor division (data_chars/2) is used for heap allocation, but when data_chars is odd, ceil(data_chars/2) bytes are written, causing a 1-byte heap buffer overflow. The attack is triggered by opening a malformed DCT2000 capture file with Wireshark or tshark; no authentication or user interaction beyond opening the file is required. An attacker can cause a denial of service (application crash), and potentially achieve code execution depending on heap layout. Fixed versions are 4.6.8 and 4.4.18, released in August 2026.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.7, 4.4.0 to 4.4.17
Timeline
- 2026-08-12: disclosed: Wireshark security advisory wnpa-sec-2026-74 published
- 2026-08-19: patched: Fixed in Wireshark 4.6.8 and 4.4.18