Executive brief
Wireshark, a widely-used network traffic analysis tool, contains a crash vulnerability in its Bluetooth BR/EDR protocol dissector. An attacker can craft a malicious Bluetooth packet capture file that, when opened in Wireshark or TShark, causes the application to crash and terminate abnormally. While the crash itself does not enable data theft or system compromise, it can disrupt network analysis workflows and be weaponized in scenarios where untrusted capture files are processed automatically.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the Bluetooth BR/EDR RF dissector. The dissector declares a static L2CAP reassembly table (`l2cap_msg_reassembly_table`) but fails to register it using the standard `reassembly_table_register()` mechanism, leaving its callback pointers uninitialized. When processing a fragmented L2CAP message with truncated payload (LLID 2 with declared length exceeding available data), the dissector calls `fragment_add_seq_next()` with NULL callbacks, resulting in a read through address zero and immediate segmentation fault. Exploitation requires a valid Bluetooth BR/EDR connection state in the capture file, making it deterministic but requiring crafted setup frames. The fix registers the reassembly table properly with initialized callbacks during protocol registration. Patches are available in Wireshark 4.6.8 and 4.4.18.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.7, 4.4.0 to 4.4.17
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Fixed in Wireshark 4.6.8 and 4.4.18
- 2026-08-19: advisory