CVE-2026-5653: 
Wireshark vulnerability analysis and mitigation

CVE-2026-5653 is a heap-based buffer overflow vulnerability in Wireshark's DCP-ETSI protocol dissector that allows denial of service via a crafted packet or capture file. It affects Wireshark versions 4.4.0 through 4.4.14 and 4.6.0 through 4.6.4. The vulnerability was published on April 30, 2026, with patches available in versions 4.4.15 and 4.6.5. It carries a CVSS v3.1 base score of 7.5 (High) per NVD, and 5.5 (Moderate) per the GitHub Advisory Database and ENISA EUVD, reflecting differing assessments of the attack vector (GitHub Advisory, Wireshark Advisory).

The root cause is a heap-based buffer overflow (CWE-122) in Wireshark's DCP-ETSI (Digital Radio Mondiale / Digital Audio Broadcasting) protocol dissector. The flaw is triggered when processing a maliciously crafted DCP-ETSI PFT (Packet Framing and Transport) fragment structure, either via live network capture or by opening a crafted PCAP file. A proof-of-concept capture file (dcp_etsi_heap_overflow.pcap) has been published on the Wireshark GitLab issue tracker, with ASAN output confirming heap memory corruption at packet dissection time (Wireshark GitLab Issue, GitHub Advisory). Exploitation requires either user interaction (opening a malicious PCAP file) or network access to a Wireshark instance actively capturing DCP-ETSI traffic.

Successful exploitation causes Wireshark to crash, resulting in a denial of service — the application becomes unavailable for the duration of the attack or until restarted. There is no assessed impact on confidentiality or data integrity, as the vulnerability is limited to availability. While heap buffer overflows can theoretically be leveraged for code execution, no such capability has been demonstrated for this specific vulnerability, and the primary confirmed impact remains application crash (Wireshark Advisory, GitHub Advisory).

A proof-of-concept exploit in the form of a crafted PCAP file (dcp_etsi_heap_overflow.pcap) with reproduction steps is publicly available on the Wireshark GitLab issue tracker (Wireshark GitLab Issue). As of the time of reporting, there is no evidence of active in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of exploitation in the near term. No threat actor attribution has been identified (GitHub Advisory).

1. Obtain or craft a malicious PCAP file: Create or download a crafted PCAP file containing a malformed DCP-ETSI PFT fragment structure (e.g., dcp_etsi_heap_overflow.pcap referenced in the public GitLab issue).
2. Deliver the file to the target: Send the crafted PCAP to a target user via email, file share, or other means, or position the malicious traffic on a network segment being captured by a Wireshark instance.
3. Trigger dissection: Induce the target to open the PCAP file in a vulnerable version of Wireshark (4.4.0–4.4.14 or 4.6.0–4.6.4), or ensure the malicious DCP-ETSI packets are captured during live network analysis.
4. Achieve denial of service: The DCP-ETSI dissector processes the malformed PFT fragment, triggering a heap buffer overflow that causes Wireshark to crash, denying the analyst use of the tool (Wireshark GitLab Issue).

• File System: Presence of unexpected or externally sourced PCAP files (e.g., dcp_etsi_heap_overflow.pcap) in user download directories or shared folders.
• Process: Wireshark process terminating unexpectedly or generating crash dumps/core files after opening a PCAP or capturing DCP-ETSI traffic.
• Logs: Application crash logs or ASAN output referencing heap-buffer-overflow in Wireshark's DCP-ETSI dissector code path at packet dissection time.
• Network: Unusual DCP-ETSI protocol traffic (UDP-based, typically on ports used for DAB/DRM broadcasting) appearing on networks where such traffic is not expected (Wireshark GitLab Issue).

Users should upgrade Wireshark to version 4.4.15 or 4.6.5, which contain fixes for this vulnerability (Wireshark Advisory, Wireshark 4.6.5 Release Notes). As a workaround, users can avoid opening PCAP files from untrusted sources and restrict Wireshark from capturing or processing DCP-ETSI protocol traffic on untrusted networks. Linux distribution users should apply vendor-provided packages (Debian DSA, SUSE updates) as they become available.

Cybersecurity news outlets including CyberSecurityNews and Cryptika covered the vulnerability as part of broader reporting on Wireshark security issues in the April/May 2026 release cycle (CyberSecurityNews). The Wireshark project issued an official security advisory (wnpa-sec-2026-22) and announced patched releases via their mailing lists. Nessus detection plugins (IDs 313009 and 318251) were released by Tenable to identify vulnerable installations (Tenable).