Executive brief
Wireshark is a network protocol analyzer widely used to capture and examine network traffic. The CMS (Cryptographic Message Syntax) dissector contains a use-after-free flaw that allows an attacker to crash Wireshark by sending specially crafted network packets. An attacker can exploit this vulnerability by opening a malicious packet capture file or by sending crafted LDAP packets over a network, causing the application to crash and denying service to legitimate users.
Technical details
The vulnerability is a use-after-free bug (CWE-416) in Wireshark's CMS protocol dissector that stores packet-scoped tree pointers in file-static variables (cap_tree and top_tree). After a packet's memory pool is reset, these non-NULL pointers remain and are reused by subsequent packets, causing heap-use-after-free conditions when RC2 parameter decoding or eContent callbacks attempt to append text to or dispatch through freed proto_item structures. The flaw affects versions 4.6.0–4.6.7 and 4.4.0–4.4.18. Attack vectors include opening a crafted PCAP file (requires user interaction) or live packet dissection over LDAP/UDP (no interaction needed). The crash is deterministic and confirmed via ASan heap-use-after-free reports in proto_item_append_text() and call_dissector_work(). Patches moving these pointers into packet-scoped cms_private_data structures are available.
Affected products
- Wireshark Wireshark 4.4.0 to 4.4.18, 4.6.0 to 4.6.7
Timeline
- 2026-08-19: disclosed