Executive brief
Wireshark is a network protocol analyzer used to inspect and troubleshoot network traffic. The SSH protocol dissector contains a heap buffer overflow vulnerability when processing curve25519 key exchange, allowing an attacker to crash Wireshark by providing a malformed capture file or injecting a crafted network packet. This can disrupt incident response activities and network troubleshooting operations.
Technical details
The vulnerability is a heap buffer overflow in the SSH dissector's curve25519 key exchange handling. The root cause is in `ssh_kex_shared_secret()` which allocates a buffer sized from an attacker-controlled length value read from the wire (1–31 bytes), then passes it to `crypto_scalarmult_curve25519()` which unconditionally writes and reads exactly 32 bytes. This causes out-of-bounds heap read and write of up to 31 bytes. The vulnerability can be triggered by opening a capture file or processing a network packet with malformed curve25519 key material; no authentication or user interaction is required beyond opening the file. An attacker can crash Wireshark, causing denial of service. Patches are available in Wireshark 4.6.8 and 4.4.18.
Affected products
- Wireshark Wireshark 4.6.0 to 4.6.7, 4.4.0 to 4.4.17
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Fixed in Wireshark 4.6.8 and 4.4.18