Executive brief
Wireshark's UMTS FP protocol dissector contains a memory safety flaw that can crash the application when processing specially crafted network packets or capture files. An attacker could exploit this by injecting malformed packets into a network or tricking a user into opening a malicious packet capture file, resulting in service disruption to anyone relying on Wireshark for network analysis.
Technical details
The vulnerability is an out-of-bounds write in the UMTS FP dissector's dissect_e_dch_t2_or_common_channel_info() function. The dissector reads a packet-controlled continuation flag (F) and uses it to loop through MAC-is SDU descriptors, but fails to enforce a bounds check on a 16-element fixed array. By setting the continuation flag to keep the loop running, an attacker can force writes past index 15 into mac_is_lchid and mac_is_length arrays, triggering undefined behavior and a crash. The attack requires network access to inject malformed packets or local access to deliver a malicious capture file; no authentication is required. This has been patched in Wireshark 4.6.8, 4.4.18, and later.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.7, 4.4.0 to 4.4.17
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Fixed in Wireshark 4.6.8, 4.4.18