CVE-2026-15174: 
Wireshark vulnerability analysis and mitigation

CVE-2026-15174 is a denial-of-service vulnerability in Wireshark's Catapult DCT2000 protocol dissector that causes the application to crash when processing malformed packets or capture files. It affects Wireshark versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. The vulnerability was published on July 8, 2026, with patches available in versions 4.6.7 and 4.4.17. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Wireshark Advisory).

The vulnerability is classified under CWE-122 (Heap-based Buffer Overflow) and CWE-476 (NULL Pointer Dereference), indicating that the Catapult DCT2000 dissector fails to properly validate or handle malformed protocol data, leading to a crash (GitHub Advisory). The attack vector is local, requiring no privileges but necessitating user interaction — specifically, a user must open a specially crafted packet capture file containing malformed Catapult DCT2000 protocol data. The issue is tracked upstream in the Wireshark GitLab issue tracker (Wireshark Advisory). No public proof-of-concept exploit code has been confirmed at this time.

Successful exploitation results in a crash of the Wireshark application, causing a denial of service with high availability impact and no confidentiality or integrity impact. The scope is limited to the Wireshark process itself, with no evidence of lateral movement potential or data exposure risk. Affected users would lose access to the packet analysis functionality until the application is restarted, and repeated exploitation could disrupt network analysis workflows (GitHub Advisory, Red Hat Bugzilla).

1. Craft malicious capture file: Create a specially crafted packet capture file (e.g., .pcap or .pcapng) containing malformed Catapult DCT2000 protocol packets designed to trigger a heap-based buffer overflow or NULL pointer dereference in the dissector.
2. Deliver the file: Deliver the malicious capture file to the target user via email attachment, file share, or social engineering, as exploitation requires the user to open the file in Wireshark.
3. Trigger dissector crash: When the victim opens the malicious capture file in a vulnerable version of Wireshark (4.6.0–4.6.6 or 4.4.0–4.4.16), the Catapult DCT2000 dissector processes the malformed data and crashes the application, resulting in denial of service (Wireshark Advisory, GitHub Advisory).

• File System: Presence of unexpected or unsolicited .pcap/.pcapng files containing Catapult DCT2000 protocol data delivered via email or file shares.
• Logs: Wireshark crash reports or core dump files generated after opening a capture file; application crash logs referencing the DCT2000 dissector module.
• Process: Unexpected termination of the Wireshark process (wireshark, tshark, or dumpcap) shortly after opening a capture file.

Users should upgrade Wireshark to version 4.6.7 or later (for the 4.6.x branch) or 4.4.17 or later (for the 4.4.x branch) to remediate this vulnerability (Wireshark Advisory). As a workaround, users should avoid opening untrusted or unknown packet capture files in Wireshark until patched. Fedora and other Linux distributions have begun issuing updated packages incorporating the fix (Linux Security).

The vulnerability was covered by VPN Central in the context of a broader Wireshark 4.6.7 release that addressed 12 security flaws (VPN Central). Red Hat opened a tracking bug and Kaspersky's threat intelligence platform catalogued the vulnerability, indicating routine vendor awareness without significant alarm given the medium severity rating. No notable researcher commentary or social media discussion has been identified beyond standard vulnerability aggregator coverage.