CVE-2026-5409: 
Wireshark vulnerability analysis and mitigation

CVE-2026-5409 is a denial-of-service vulnerability in Wireshark's Monero protocol dissector caused by uncontrolled recursion (CWE-674). It affects Wireshark versions 4.4.0 through 4.4.14 and 4.6.0 through 4.6.4, and was published on April 30, 2026 with patches released the same day. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium severity) (GitHub Advisory, Wireshark Advisory).

The root cause is uncontrolled recursion (CWE-674) in Wireshark's Monero protocol dissector, which fails to limit recursive processing depth when parsing crafted packet data. An attacker can craft a malicious PCAP file or inject specially formed Monero protocol packets that trigger excessive stack consumption, ultimately causing a stack overflow and SIGSEGV crash. Exploitation requires user interaction — the victim must open a malicious capture file or capture live traffic containing the crafted packets — and no elevated privileges are needed. A public proof-of-concept Python script (generate_monero.py) that generates a triggering PCAP file (monero_stack_overflow.pcap) is available, with reproduction via ./build/run/tshark -r monero_stack_overflow.pcap resulting in exit code 139 (SIGSEGV) (Wireshark Issue).

Successful exploitation causes Wireshark to crash with a SIGSEGV (stack overflow), resulting in a denial of service — the application becomes completely unavailable. There is no impact on confidentiality or data integrity, and the scope is limited to the Wireshark process itself. The vulnerability does not enable code execution, lateral movement, or data exfiltration based on current analysis (GitHub Advisory, Wireshark Advisory).

Public proof-of-concept exploit code is available on the Wireshark GitLab issue tracker, consisting of a Python script that generates a malicious PCAP file to reliably reproduce the crash (Wireshark Issue). There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.013–0.016%, indicating a low probability of exploitation in the near term (GitHub Advisory).

1. Craft malicious PCAP: Use the publicly available generate_monero.py Python script to generate a malicious capture file (monero_stack_overflow.pcap) containing Monero protocol packets crafted to trigger uncontrolled recursion in Wireshark's dissector.
2. Deliver the payload: Distribute the malicious PCAP file to a target user via email, file share, or other means, or position the crafted packets on a network segment being monitored by the target's Wireshark instance.
3. Trigger dissection: Induce the victim to open the malicious PCAP file in Wireshark or Tshark (e.g., tshark -r monero_stack_overflow.pcap), or capture live traffic containing the crafted Monero packets.
4. Crash achieved: The Monero dissector enters uncontrolled recursion, exhausts the stack, and Wireshark/Tshark terminates with a SIGSEGV (exit code 139), achieving denial of service (Wireshark Issue).

• Process: Wireshark or Tshark process terminating unexpectedly with exit code 139 (SIGSEGV/segmentation fault), particularly when processing Monero protocol traffic or opening PCAP files.
• Logs: System crash logs or core dump files referencing Wireshark/Tshark with stack overflow indicators; application crash reports showing recursive call stacks in the Monero dissector.
• File System: Presence of unexpected PCAP files (e.g., monero_stack_overflow.pcap) or Python scripts (e.g., generate_monero.py) on analyst workstations.
• Network: Unusual Monero protocol traffic on monitored network segments, particularly packets with deeply nested or malformed structures not consistent with legitimate Monero node communication (Wireshark Issue).

Wireshark has released patched versions 4.4.15 and 4.6.5, which address this vulnerability; users should upgrade immediately (Wireshark Advisory, Release Notes). As a temporary workaround, administrators can disable the Monero protocol dissector in Wireshark's preferences or restrict packet capture to trusted network sources. Debian and other Linux distributions have also issued updated packages addressing this flaw.

Wireshark published a security advisory (WNPA-SEC-2026-08) and release notes for versions 4.4.15 and 4.6.5 on April 30, 2026, promptly addressing the issue (Wireshark Advisory). Security news outlets including CyberSecurityNews and Cryptika covered the vulnerability in the context of broader Wireshark security fixes released in the same update cycle (CyberSecurityNews). Tenable released multiple Nessus detection plugins (311426, 311427, 311436, 311437, 313009) shortly after disclosure, and Debian issued a security advisory (DSA-6249-1) for its Wireshark packages.