Executive brief
Wireshark is a widely-used network packet analyzer that dissects and displays network traffic. A crafted RDP packet can trigger a heap buffer overflow in the ZGFX decompressor, causing Wireshark to crash or potentially allowing code execution when analyzing captured network traffic or opening a malicious packet capture file.
Technical details
The RDP8/ZGFX decompressor in Wireshark contains an off-by-one boundary check in the zgfx_write_literal() function: it guards against writing past a 65536-byte output buffer with an equality test (outputCount == 65535) instead of a bounds check (>=). An attacker-controlled RDP EGFX or DRDYNVC channel payload can set outputCount to exactly 65536, bypassing the guard, then write subsequent literal bytes past the buffer boundary. The vulnerability is reachable through the default RDP dissectors with no authentication or user interaction required—analysis of a crafted packet capture file via tshark or the Wireshark GUI is sufficient. Patches are available in versions 4.6.8 and 4.4.18.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.7, 4.4.0 to 4.4.17
Timeline
- 2026-08-12: disclosed: Wireshark security advisory wnpa-sec-2026-67 published
- 2026-08-19: patched: Fixes available in Wireshark 4.6.8 and 4.4.18