Executive brief
Wireshark is a network protocol analyzer used to inspect and troubleshoot network traffic. A malformed BUSMASTER capture file can cause Wireshark to terminate abnormally, disrupting incident response activities or automated traffic analysis pipelines. An attacker can exploit this by distributing a malicious capture file that causes the application to crash when opened.
Technical details
The vulnerability exists in the BUSMASTER file parser lexer (wiretap/busmaster_scanner.l:105), where a newline character in an unfinished HEADER or TIME statement triggers Flex's fatal-error path, which calls exit(2) instead of returning a parse error. The attack vector is local and requires user interaction (opening a file). An attacker can craft a minimal malformed BUSMASTER capture file (as simple as `***\n` bytes) that causes Wireshark, TShark, or any application embedding libwiretap to terminate unexpectedly during format detection. No special privileges or authentication is required. Patched versions (4.6.8, 4.4.18) have been released that convert the fatal error into a graceful parse failure, allowing the application to continue and report the file as unsupported.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.7, 4.4.0 to 4.4.17
Timeline
- 2026-08-12: disclosed
- 2026-08-19: patched: Fixed in Wireshark 4.6.8 and 4.4.18