CVE-2026-15173: 
Wireshark vulnerability analysis and mitigation

CVE-2026-15173 is a denial-of-service vulnerability in Wireshark's pcapng file parser that causes an application crash when processing a maliciously crafted pcapng file. It affects Wireshark versions 4.6.0 through 4.6.6, with version 4.6.7 being the first patched release. The vulnerability was published on July 8, 2026, and assigned by GitLab. It carries a CVSS v3.1 base score of 5.5 (Medium) per NVD, or 4.7 (Medium) per the GitHub Advisory Database (GitHub Advisory, Wireshark Advisory, Red Hat Bugzilla).

The vulnerability is rooted in two weaknesses: a heap-based buffer overflow (CWE-122) and an expired pointer dereference (CWE-825) within the pcapng file parser component of Wireshark. An attacker can trigger the crash by crafting a malicious pcapng file and inducing a local user to open it with a vulnerable Wireshark instance — no elevated privileges are required, but user interaction is necessary. The attack vector is local, meaning the attacker must be able to deliver the malicious file to the victim's system. A related GitLab work item tracks the underlying defect (GitHub Advisory, Wireshark Advisory).

Successful exploitation results in a crash of the Wireshark application, causing a denial of service for the affected user. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability of the Wireshark process itself. Because Wireshark is a network analysis tool rather than a network-facing service, the impact is confined to the local workstation and does not enable lateral movement or remote code execution (GitHub Advisory, Red Hat Bugzilla).

1. Craft malicious pcapng file: Create a specially crafted pcapng file that triggers a heap-based buffer overflow or expired pointer dereference in Wireshark's pcapng parser, exploiting improper memory handling in versions 4.6.0–4.6.6.
2. Deliver the file: Distribute the malicious pcapng file to the target via email attachment, file share, download link, or physical media — any method that places the file on the victim's local system.
3. Induce user interaction: Social-engineer the target user into opening the crafted pcapng file with a vulnerable Wireshark instance (e.g., by disguising it as a legitimate network capture).
4. Trigger crash: Upon parsing the malicious file, Wireshark crashes due to the heap buffer overflow or expired pointer dereference, resulting in denial of service for the application (GitHub Advisory, Wireshark Advisory).

• File System: Presence of unexpected or externally sourced .pcapng files in user download directories, temp folders, or email attachments.
• Logs: Wireshark crash reports or core dump files generated after opening a pcapng file; application error logs referencing memory access violations or segmentation faults in the pcapng parser.
• Process: Unexpected termination of the Wireshark process (wireshark, tshark, or dumpcap) shortly after opening a pcapng file, particularly with heap corruption signals in crash telemetry.

Users should upgrade Wireshark to version 4.6.7 or later, which resolves the pcapng parser crash (Wireshark Advisory). As an interim workaround, avoid opening pcapng files from untrusted or unknown sources. Additionally, restricting file system permissions to limit which users can access or open pcapng files can reduce exposure until patching is complete. Fedora users can apply the updated Wireshark package available through the distribution's update channels (Red Hat Bugzilla).

Red Hat tracked the vulnerability via its Product Security team and opened a Bugzilla entry shortly after disclosure, indicating standard triage for medium-severity issues affecting downstream distributions (Red Hat Bugzilla). Fedora issued an update advisory incorporating the fix, and Linux security news outlets covered the update as part of routine Wireshark maintenance (Linux Security). No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.