Executive brief
Wireshark is a network traffic analysis tool used by network administrators and security professionals to inspect network packets. A flaw in the H.245 protocol dissector allows a specially crafted network packet to crash Wireshark or TShark, causing a denial of service. An attacker could exploit this by sending a malformed H.245 message over the network or by distributing a malicious packet capture file.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the H.245 protocol dissector's handling of recursive GenericMessage decoding. The vulnerable component at epan/dissectors/packet-h245.c (lines 6575-6584, 14042-14059) deliberately clears the h245_pi packet-state pointer during returnedFunction recursive dissection. When an inner H.239 GenericMessage is subsequently processed, the dissector attempts to write a frame label through the null pointer via snprintf(), triggering a segmentation fault. No established H.245 negotiation, prior call state, or authentication is required; a crafted H.245 control message transmitted directly (e.g., via LINKTYPE_WIRESHARK_UPPER_PDU) is sufficient. A proof-of-concept exploit packet has been demonstrated to reliably crash both Wireshark and TShark. The fix, available in versions 4.6.8 and 4.4.18, guards the H.239 metadata block with a null check before attempting to dereference h245_pi.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.7, 4.4.0 to 4.4.17
Timeline
- 2026-08-19: disclosed
- 2026-08: patched: Fixed in Wireshark 4.6.8 and 4.4.18