CVE-2026-19694: 
Wireshark vulnerability analysis and mitigation

CVE-2026-19694 is a heap-based buffer overflow vulnerability in Wireshark's TTX Logger file parser that allows denial of service. It affects Wireshark versions 4.6.0 through 4.6.7 (fixed in 4.6.8), developed by the Wireshark Foundation. The vulnerability was published on August 13, 2026, with a patch advisory released the same day. It carries a CVSS v3.1 base score of 4.7 (Medium) (GitHub Advisory, Wireshark Advisory).

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow), occurring in Wireshark's TTX Logger file parser when processing malformed input files. An attacker can craft a specially malformed TTX Logger file that, when opened by a victim, triggers a heap buffer overflow causing the application to crash. Exploitation requires local access and user interaction (the victim must open the malicious file), and attack complexity is rated High, indicating specific conditions must be met. The issue is tracked upstream in the Wireshark GitLab issue tracker (GitHub Advisory, Wireshark GitLab).

Successful exploitation results in a crash of the Wireshark application, causing a denial of service condition. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. The scope is unchanged, meaning the impact is confined to the Wireshark process itself and does not affect other system components or enable lateral movement (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a victim to manually open a crafted TTX Logger file, and attack complexity is rated High, further limiting practical exploitability (GitHub Advisory, Wireshark Advisory).

1. Craft malicious file: Create a specially malformed TTX Logger file designed to trigger a heap-based buffer overflow in Wireshark's TTX Logger file parser.
2. Deliver the file: Distribute the malicious file to a target user via email attachment, file share, or other social engineering means, as exploitation requires user interaction.
3. Victim opens the file: The target user opens the crafted TTX Logger file in a vulnerable version of Wireshark (4.6.0–4.6.7).
4. Trigger crash: The malformed file causes a heap buffer overflow in the parser, crashing the Wireshark application and resulting in a denial of service (GitHub Advisory).

• File System: Presence of unexpected or unsolicited .ttx or TTX Logger-format files in directories accessible to Wireshark users.
• Process: Wireshark process terminating unexpectedly or generating crash dumps/core files after opening a TTX Logger file.
• Logs: Application crash reports or Windows Error Reporting entries referencing Wireshark process faults; system event logs showing abnormal Wireshark termination.

Users should upgrade Wireshark to version 4.6.8 or later, which resolves this vulnerability. Until patching is possible, users should avoid opening TTX Logger files from untrusted or unknown sources, and organizations should implement file access controls to restrict which files can be provided for analysis. The official security advisory is available at the Wireshark security page (Wireshark Advisory, GitHub Advisory).