Executive brief
Wireshark's ERF (Extensible Record Format) file parser contains a vulnerability that can cause the application to crash when processing malformed capture files. An attacker could exploit this by crafting a specially-designed packet capture file that, when opened in Wireshark, triggers a denial of service by crashing the application and potentially interrupting network analysis and incident investigation activities.
Technical details
The vulnerability is an out-of-bounds heap read in the ERF metadata parser (wiretap/erf.c). The erf_meta_read_tag() function accepts a short gen_time tag when its aligned total length fits in the remaining record buffer, but populate_summary_info() unconditionally copies sizeof(state.gen_time) (8 bytes) from tag.value without validating tag.length. An attacker can craft a malformed ERF capture file with a truncated gen_time tag positioned at the end of a record, causing the memcpy to read 8 bytes beyond the allocated buffer. The vulnerability requires user interaction (opening a malicious capture file) and can be triggered through the normal Wireshark file open path or command-line tools like tshark and capinfos. Patches are available in Wireshark 4.6.8 and 4.4.18.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.7, 4.4.0 to 4.4.17
Timeline
- 2026-08-12: disclosed
- 2026-08-19: patched: Fixed in Wireshark 4.6.8 and 4.4.18