Executive brief
Wireshark, a widely-used packet analysis tool, contains a heap buffer overflow vulnerability in its C12.22 protocol dissector. An attacker can craft a malformed packet to trigger the crash, potentially disrupting security analysts' ability to monitor network traffic. The vulnerability requires decryption to be enabled and a matching decryption key configured, but authentication is not enforced before the buffer overflow occurs.
Technical details
The vulnerability is a heap buffer overflow (CWE-190, CWE-122) in the EAX CMAC decryption helper within wsutil/eax.c. The `Eax_Decrypt()` function accepts 32-bit length parameters but passes them to 16-bit CMAC helpers (dCMAC), causing integer truncation. In C12.22 cleartext-authentication mode, this truncation wraps the summed component lengths, resulting in a small heap allocation followed by much larger memcpy() operations that overflow the buffer. The vulnerability is reachable through reassembled C12.22 TCP/1153 traffic when c1222.decrypt is enabled and a decryption-table entry matches the packet's key ID. A 65,576-byte payload reliably triggers a heap-buffer-overflow detected by ASan; process crash is confirmed though code execution was not demonstrated. Patches are available in Wireshark 4.6.8 and 4.4.18.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.7, 4.4.0 to 4.4.17
Timeline
- 2026-08-19: disclosed
- 2026-08: patched: Fixed in versions 4.6.8 and 4.4.18