Executive brief
Wireshark is a network packet analyzer used by IT professionals to diagnose network issues and investigate security incidents. A flaw in the X.509IF protocol dissector (used to decode certificate-related network traffic) can cause Wireshark to crash when processing specially crafted network packets or malicious capture files. An attacker could exploit this to disrupt incident response activities or prevent legitimate security analysis.
Technical details
The X.509IF dissector uses shared file-static state to format Distinguished Names (DN) and Relative Distinguished Names (RDN). When an RDN attribute value recursively decodes another DistinguishedName, the inner decoder overwrites and clears the `last_rdn_buf` state variable; the outer decoder then resumes and passes NULL to `wmem_strbuf_get_str()`, triggering a null-pointer dereference. The vulnerability is reachable via LDAP ExtendedRequest packets on UDP/389 without authentication, session validation, or cryptography. The root cause lies in lack of state preservation across nested decoding at `epan/dissectors/asn1/x509if/x509if.cnf` lines 330-355. A deterministic crash is confirmed via AddressSanitizer (ASan) on both Wireshark and TShark; patches are available in versions 4.6.8 and 4.4.18.
Affected products
- Wireshark Foundation Wireshark 4.6.0 to 4.6.7, 4.4.0 to 4.4.17
Timeline
- 2026-08-12: disclosed
- 2026-08-19: patched: Patches available in versions 4.6.8 and 4.4.18