CVE-2026-19695: 
Wireshark vulnerability analysis and mitigation

CVE-2026-19695 is a stack-based buffer overflow vulnerability in Wireshark's Gammu DCT3 trace file parser that allows a local attacker to cause a denial of service (application crash). It affects Wireshark versions 4.6.0 through 4.6.7, with version 4.6.8 and later listed as unaffected. The vulnerability was published on August 13, 2026, and carries a CVSS v3.1 base score of 4.7 (Medium), assigned by GitLab (GitHub Advisory, Wireshark Advisory).

The root cause is a stack-based buffer overflow (CWE-121) in Wireshark's Gammu DCT3 trace file parser. An attacker can craft a malicious DCT3 trace file that, when opened by a victim user, triggers the overflow and crashes the application. Exploitation requires local access and user interaction (the victim must open the crafted file), and the attack complexity is rated High, indicating that specific conditions must be met for successful exploitation (GitHub Advisory, Wireshark GitLab).

Successful exploitation results in a crash of the Wireshark application, causing a denial of service. There is no impact on confidentiality or data integrity — only availability is affected. The scope is limited to the local Wireshark instance; there is no evidence of potential for lateral movement or sensitive data exposure (GitHub Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a victim to manually open a specially crafted DCT3 trace file, significantly limiting the attack surface (GitHub Advisory).

1. Craft malicious trace file: Create a specially crafted Gammu DCT3 trace file designed to trigger a stack-based buffer overflow in Wireshark's DCT3 parser.
2. Deliver the file: Use social engineering, phishing, or file-sharing mechanisms to deliver the malicious trace file to a target user running Wireshark 4.6.0–4.6.7.
3. Trigger parsing: Convince the victim to open the crafted file in Wireshark (e.g., via File > Open or drag-and-drop), which initiates parsing by the vulnerable Gammu DCT3 trace file parser.
4. Achieve denial of service: The buffer overflow causes Wireshark to crash, resulting in a denial of service for the affected user (GitHub Advisory, Wireshark GitLab).

• File System: Presence of unexpected or externally sourced .dct3 or similarly named trace files in user download directories or shared folders.
• Logs: Wireshark crash reports or application error logs referencing the DCT3 dissector or Gammu parser at the time of file opening.
• Process: Unexpected termination of the Wireshark process (wireshark.exe or wireshark) shortly after opening a trace file, potentially generating a crash dump or core file.

Users should upgrade Wireshark to version 4.6.8 or later, which is listed as unaffected by this vulnerability (Wireshark Advisory). As interim mitigations, restrict access to DCT3 trace file parsing functionality to trusted users, implement file type validation and size limits on trace files before processing, and avoid opening trace files from untrusted sources. Organizations should also consider disabling or restricting the Gammu DCT3 dissector in Wireshark preferences if DCT3 trace analysis is not required.