CVE-2026-3201: 
Wireshark vulnerability analysis and mitigation

CVE-2026-3201 is a memory exhaustion vulnerability in the USB HID protocol dissector of Wireshark that allows denial of service. It affects Wireshark versions 4.4.0 through 4.4.13 and 4.6.0 through 4.6.3. The vulnerability was disclosed on February 25, 2026, with patches released shortly after. NVD assigns a CVSS v3.1 base score of 7.5 (High), while the CNA (GitLab Inc.) scores it 4.7 (Medium) reflecting the local attack vector and required user interaction (Wireshark Advisory, Red Hat Bugzilla).

The root cause is improperly controlled sequential memory allocation (CWE-1325) and allocation of resources without limits or throttling (CWE-770) in Wireshark's USB HID protocol dissector. When parsing a specially crafted packet capture file, the dissector performs unbounded memory allocations, exhausting available system memory. Exploitation requires a user to open a malicious .pcap or packet capture file containing crafted USB HID data — no network-facing attack surface is involved. A proof-of-concept issue is tracked at the Wireshark GitLab repository (GitLab Issue, Wireshark Advisory).

Successful exploitation causes Wireshark to exhaust available memory, resulting in an application crash and denial of service. The impact is limited to availability — there is no confidentiality or integrity impact, and no code execution is possible. The scope is confined to the affected Wireshark process on the local system, with no lateral movement potential (Wireshark Advisory, Red Hat Bugzilla).

1. Craft malicious capture file: Create a specially crafted .pcap or .pcapng file containing USB HID protocol packets designed to trigger unbounded sequential memory allocations in the dissector.
2. Deliver the file: Distribute the malicious capture file to a target user via email attachment, file share, or social engineering, exploiting the common analyst workflow of opening packet captures for inspection.
3. User opens the file: The target opens the malicious file in an affected version of Wireshark (4.4.0–4.4.13 or 4.6.0–4.6.3).
4. Memory exhaustion triggered: The USB HID dissector processes the crafted packets and performs unthrottled sequential memory allocations, exhausting system memory.
5. Denial of service achieved: Wireshark crashes due to memory exhaustion, disrupting the analyst's workflow and potentially causing loss of unsaved analysis work (GitLab Issue, Wireshark Advisory).

• File System: Presence of unexpected or unsolicited .pcap / .pcapng files containing USB HID traffic delivered via email or file sharing platforms.
• Process: Wireshark process (wireshark, tshark) terminating abnormally with out-of-memory errors or crash dumps after opening a specific capture file.
• Logs: Operating system logs (e.g., /var/log/syslog, Windows Event Log) recording OOM (out-of-memory) kill events or application crash events attributed to the Wireshark process.
• Memory: Sudden spike in memory consumption by the Wireshark process immediately upon opening a specific capture file, visible via system monitoring tools.

Users should upgrade to Wireshark 4.4.14 or later (for the 4.4.x branch) or 4.6.4 or later (for the 4.6.x branch) to remediate this vulnerability. Red Hat Enterprise Linux 10 users can apply the fix via errata RHSA-2026:9666. As a workaround, restrict users from opening untrusted or unsolicited packet capture files, and educate analysts to avoid opening .pcap files from unknown sources. SUSE, Fedora, Debian, and other Linux distributions have also released updated packages (Wireshark Advisory, Red Hat Errata, Red Hat Bugzilla).

The Wireshark project announced the fix via its mailing lists and security advisory page, with the 4.6.4 and 4.4.14 releases receiving coverage from Linux-focused outlets such as Linuxiac and LinuxCompatible. SUSE, Fedora, Debian, and AlmaLinux all issued downstream security updates. Community reaction has been measured given the limited exploitability — no significant alarm was raised, and the vulnerability is generally regarded as low-risk due to the requirement for user interaction and local access (Linuxiac, Wireshark Users List).