CVE-2026-5403: 
Wireshark vulnerability analysis and mitigation

CVE-2026-5403 is a heap-based buffer overflow vulnerability in Wireshark's SBC codec parser that can lead to denial of service and possible arbitrary code execution. It affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. The vulnerability was published on May 1, 2026, with patches available in versions 4.6.5 and 4.4.15. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Wireshark Advisory).

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write), rooted in improper bounds checking within the SBC codec dissector. An attacker can trigger the overflow by causing a victim to open or process a specially crafted capture file (e.g., a malicious .pcapng file) containing malformed SBC codec data, or by feeding such data through sharkd via JSON-RPC commands. Exploitation requires local access and user interaction — the victim must open the malicious file or the attacker must interact with a running Wireshark/sharkd instance. A public proof-of-concept including a crafted exploit_ws_sbc_real.pcapng file, step-by-step sharkd reproduction instructions, and a Python PoC generator script (exploit_wireshark_sbc_heap_overflow.py) has been published (Wireshark Issue Tracker).

Successful exploitation can cause Wireshark or sharkd to crash (denial of service) and potentially allows an attacker to execute arbitrary code with the privileges of the Wireshark process. Given that Wireshark is commonly run by security analysts and network engineers — sometimes with elevated privileges — code execution could expose sensitive captured network data, credentials, or allow further compromise of the analyst's workstation. The local attack vector limits the blast radius compared to network-exploitable vulnerabilities, but the high confidentiality, integrity, and availability impacts make this a significant risk in environments where untrusted capture files are routinely opened (GitHub Advisory, Wireshark Advisory).

A public proof-of-concept exploit is available on the Wireshark GitLab issue tracker, including a self-contained malicious pcapng file, reproduction steps for sharkd, and a Python PoC generator script, assessed with high confidence by Feedly (Wireshark Issue Tracker). As of the time of reporting, there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.014% (1st percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory).

1. Craft a malicious capture file: Use the publicly available Python PoC generator (exploit_wireshark_sbc_heap_overflow.py) from the Wireshark GitLab issue to generate a specially crafted exploit_ws_sbc_real.pcapng file containing malformed SBC codec data designed to trigger the heap buffer overflow.
2. Deliver the file to the target: Social-engineer the victim (e.g., a network analyst) into opening the malicious .pcapng file in Wireshark, or place it in a location where it will be automatically processed.
3. Trigger via Wireshark GUI: When the victim opens the file in Wireshark, the SBC codec dissector processes the malformed data, triggering the out-of-bounds write on the heap.
4. Alternative — exploit via sharkd: If sharkd is accessible, send a crafted JSON-RPC load command referencing the malicious pcapng file: printf '{"jsonrpc":"2.0","id":1,"method":"load",...}' | ./sharkd - to trigger the overflow without user GUI interaction.
5. Achieve code execution or DoS: Depending on heap layout and memory protections, the overflow may crash the process (DoS) or, with further exploitation primitives, enable arbitrary code execution under the Wireshark/sharkd process account (Wireshark Issue Tracker).

• File System: Presence of unexpected .pcapng files with unusual SBC codec content delivered via email, file shares, or downloads; presence of exploit_wireshark_sbc_heap_overflow.py or exploit_ws_sbc_real.pcapng on disk.
• Process: Wireshark or sharkd process crashing unexpectedly or generating core dumps; unusual child processes spawned from the Wireshark or sharkd process.
• Logs: Application crash logs or Windows Event Log entries referencing Wireshark/sharkd access violations or heap corruption errors; sharkd JSON-RPC logs showing load commands referencing externally supplied pcapng files.
• Network: Outbound connections from the Wireshark process to unexpected external hosts (indicative of post-exploitation activity such as reverse shell establishment).

Wireshark has released patched versions addressing this vulnerability: 4.6.5 (for the 4.6.x branch) and 4.4.15 (for the 4.4.x branch). Users should upgrade to one of these versions immediately (Wireshark Advisory, Release Notes). As interim mitigations, restrict local access to systems running affected Wireshark versions, avoid opening untrusted or externally sourced capture files, and limit exposure of sharkd interfaces. Linux distribution users should apply vendor-provided packages (e.g., Debian DSA, SUSE updates) as they become available.

The vulnerability received broad coverage from security news outlets including CyberSecurityNews, GBHackers, CyberPress, and Heise (German-language), with several articles framing the broader Wireshark 4.6.5 release as patching over 40 security flaws (CyberSecurityNews, GBHackers, Heise). The Hacker News weekly recap also referenced the Wireshark vulnerability batch. Community sentiment on Bluesky and security forums noted the availability of a PoC but the low likelihood of widespread exploitation given the local attack vector. Tenable published multiple Nessus detection plugins (IDs 311570, 313009, 318251, 319758) for the vulnerability (Tenable).