CVE-2026-6525: 
Wireshark vulnerability analysis and mitigation

CVE-2026-6525 is a NULL Pointer Dereference vulnerability in Wireshark's IEEE 802.11 protocol dissector that causes the application to crash when processing malicious packet capture files. It affects Wireshark versions 4.6.0 through 4.6.4, with version 4.6.5 containing the fix. The vulnerability was published on May 2, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Wireshark Advisory).

The root cause is a NULL Pointer Dereference (CWE-476) in the dissect_multi_link function within Wireshark's IEEE 802.11 protocol dissector component. An attacker can craft a malicious IEEE 802.11 network packet or packet capture file that, when parsed by the dissector, triggers a dereference of a NULL pointer, causing the application to crash. Exploitation requires local access and user interaction — specifically, a user must open or process the malicious packet file — and no privileges are required (GitHub Advisory, GitLab Issue).

Successful exploitation results in a denial of service through a crash of the Wireshark application. There is no impact on confidentiality or data integrity — the vulnerability cannot be used to access sensitive data, execute arbitrary code, or compromise the underlying system. The scope is limited to the availability of the Wireshark process on the affected host (GitHub Advisory, Red Hat Bugzilla).

There is no known public proof-of-concept exploit code and no evidence of active in-the-wild exploitation as of the time of reporting. The GitLab issue tracker entry references the crash but contains no reproduction steps or exploit code (GitLab Issue). The EPSS score is approximately 0.013%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft malicious packet capture: Create a specially crafted IEEE 802.11 packet capture file (e.g., .pcap or .pcapng) that contains a malformed multi-link element designed to trigger a NULL pointer dereference in the dissect_multi_link function.
2. Deliver the file: Distribute the malicious capture file to a target user via email, file share, or other means, or position it on a network segment where the target is capturing live traffic.
3. Trigger user interaction: Induce the target user to open the malicious file in a vulnerable version of Wireshark (4.6.0–4.6.4), or have Wireshark capture live traffic containing the crafted packet.
4. Achieve denial of service: When Wireshark processes the malformed IEEE 802.11 packet, the NULL pointer dereference in the dissector causes the application to crash, disrupting the analyst's workflow (GitLab Issue, Wireshark Advisory).

• File System: Presence of unexpected or unsolicited .pcap/.pcapng files received from external sources, particularly those containing IEEE 802.11 traffic.
• Logs: Wireshark crash reports or core dump files generated after opening a packet capture file; application crash logs referencing the dissect_multi_link function or IEEE 802.11 dissector.
• Process: Unexpected termination of the Wireshark process (wireshark, tshark, or dumpcap) without user-initiated closure, particularly after opening a specific capture file.

Users should upgrade Wireshark to version 4.6.5 or later, which contains the fix for this vulnerability (Wireshark Advisory, Release Notes). As a workaround prior to patching, users should avoid opening packet capture files from untrusted or unknown sources. Organizations can also restrict the use of Wireshark to trusted capture files and implement user awareness around the risks of processing externally supplied packet data.

The vulnerability was covered by cybersecurity news outlets including CyberSecurityNews and Cryptika, though some coverage inaccurately characterized the issue as allowing code execution — the actual impact is limited to a denial of service crash (CyberSecurityNews). Wireshark announced the release of version 4.6.5 via their official mailing lists, and the fix was documented in the official release notes (Wireshark Announce). Community reaction has been low-key given the moderate severity and limited exploitability of the vulnerability.