CVE-2026-6523: 
Wireshark vulnerability analysis and mitigation

CVE-2026-6523 is an infinite loop vulnerability in the GNW (GeoNetworking) protocol dissector of Wireshark, allowing a local attacker to cause a denial of service by opening a specially crafted packet capture file. It affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. The vulnerability was published on April 30, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Wireshark Advisory).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). The GeoNetworking (GNW) protocol dissector fails to properly validate a var_len field in crafted packets; a malicious value of 0x1f in the length determinant decodes to an extremely large value (4,294,967,290 bytes), causing the dissector to enter an infinite loop and exhaust system memory until the process is killed by the OS. Exploitation requires user interaction — specifically, a victim must open a malicious .pcapng file using Wireshark or tshark. A concrete proof-of-concept pcap file (B-1-GeoNetworking-GNW-Infinite-Loop.pcapng) with reproduction steps has been publicly disclosed (Wireshark GitLab Issue).

Successful exploitation results in a denial of service — the Wireshark application (or tshark process) enters an infinite loop, consuming system memory until the process is terminated by the operating system (OOM kill). There is no impact on confidentiality or integrity; the vulnerability is limited to availability of the affected application. The scope is unchanged, meaning the impact is confined to the Wireshark process itself and does not facilitate lateral movement or data exfiltration (GitHub Advisory, Wireshark Advisory).

A proof-of-concept exploit in the form of a malicious pcap file with detailed reproduction steps is publicly available on the Wireshark GitLab issue tracker (Wireshark GitLab Issue). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.013% (2nd percentile), indicating a low probability of active exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Craft or obtain malicious pcap: Create or download a specially crafted .pcapng file (e.g., B-1-GeoNetworking-GNW-Infinite-Loop.pcapng) containing a GeoNetworking (GNW) protocol packet with an oversized var_len field set to 0x1f, which decodes to 4,294,967,290 bytes.
2. Deliver the file to the target: Use social engineering, a shared network drive, email attachment, or any other means to get the victim to open the malicious capture file with Wireshark or tshark.
3. Trigger the infinite loop: When the victim opens the file, Wireshark's GNW dissector attempts to parse the malformed packet. The invalid var_len value causes the dissector to enter an infinite loop, continuously allocating memory.
4. Denial of service achieved: The Wireshark process consumes all available system memory, eventually being killed by the OS OOM killer, resulting in application crash and denial of service (Wireshark GitLab Issue).

• Process: Wireshark or tshark process exhibiting abnormally high and continuously growing memory consumption without stabilizing.
• Logs: OS-level OOM killer log entries (e.g., Linux dmesg or /var/log/syslog) referencing the Wireshark or tshark process being killed due to out-of-memory conditions.
• File System: Presence of unexpected or externally sourced .pcapng or .pcap files, particularly those containing GeoNetworking (GNW) protocol packets with anomalous field values.
• Process: Wireshark or tshark process that becomes unresponsive (high CPU/memory, no output) shortly after opening a specific capture file (Wireshark GitLab Issue).

Wireshark has released patched versions 4.6.5 and 4.4.15, which address this vulnerability. Users should upgrade to these versions or later as the primary remediation (Wireshark Release Notes, Wireshark Advisory). As a workaround prior to patching, users should avoid opening untrusted or unknown packet capture files, and administrators should consider restricting access to Wireshark in environments where users may encounter potentially malicious capture files.

The vulnerability received standard coverage from security news outlets including CyberSecurityNews and Cryptika, which reported on multiple Wireshark vulnerabilities disclosed in the same release cycle. Tenable released Nessus detection plugins (IDs 311272, 313009, 318251) shortly after disclosure. Linux distribution security teams, including Debian and SUSE, issued advisories and package updates. No notable individual researcher commentary or significant social media discussion beyond automated CVE notification accounts was observed (CyberSecurityNews, Wireshark Announce).