CVE-2026-6535: 
Wireshark vulnerability analysis and mitigation

CVE-2026-6535 is a denial-of-service vulnerability in Wireshark's dissection engine caused by a zlib decompression crash. It affects Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. The vulnerability was published on April 30, 2026, and patches were made available the same day. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Wireshark Advisory).

The root cause is classified as CWE-1325 (Improperly Controlled Sequential Memory Allocation), where Wireshark's dissection engine fails to properly limit memory consumption during zlib decompression of network packet data. An attacker can exploit this by crafting a malformed packet or capture file containing specially structured zlib-compressed data that triggers an uncontrolled memory allocation sequence, ultimately crashing the application. Exploitation requires local access and user interaction — specifically, a user must open or analyze the malicious capture file. The vulnerability is tracked in Wireshark's issue tracker at GitLab issues #21097 and #21098 (GitHub Advisory, Wireshark Advisory).

Successful exploitation results in a crash of the Wireshark application, causing a denial of service with high availability impact. There is no impact to confidentiality or data integrity, and the scope is limited to the affected Wireshark process itself. The vulnerability cannot be used for remote code execution or lateral movement, making its primary risk the disruption of network analysis workflows for security analysts and network engineers relying on Wireshark (GitHub Advisory).

No confirmed public exploit or proof-of-concept code is available for CVE-2026-6535, and there is no evidence of in-the-wild exploitation. The EPSS score is approximately 0.012% (1st percentile), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus detection plugins (IDs 313009 and 318251) have been published to identify vulnerable installations (GitHub Advisory, Feedly).

1. Craft malicious capture file: Create a specially crafted network packet capture file (e.g., .pcap or .pcapng) containing malformed zlib-compressed data designed to trigger uncontrolled sequential memory allocation in Wireshark's dissection engine.
2. Deliver the file: Distribute the malicious capture file to a target user via email, file share, or other means, relying on social engineering to convince the user to open it in Wireshark.
3. Trigger the crash: When the target opens the file in a vulnerable version of Wireshark (4.4.0–4.4.14 or 4.6.0–4.6.4), the dissection engine attempts to decompress the zlib data, triggering the improperly controlled memory allocation and crashing the application.
4. Achieve denial of service: Wireshark terminates abnormally, disrupting any ongoing packet analysis session (GitHub Advisory, Wireshark Advisory).

• File System: Presence of unexpected or unsolicited .pcap/.pcapng files received from unknown sources; files with anomalously large or malformed zlib-compressed data sections.
• Logs: Wireshark crash reports or core dump files generated in the user's home directory or system crash log directory following the opening of a capture file.
• Process: Unexpected termination of the Wireshark process (wireshark, tshark, or dumpcap) shortly after opening a capture file, potentially logged in system event logs or crash reporters (e.g., Windows Event Log, macOS CrashReporter, Linux apport).

Users should upgrade Wireshark to version 4.4.15 or later (for the 4.4.x branch) or version 4.6.5 or later (for the 4.6.x branch), which contain fixes for this vulnerability. As a temporary workaround, users should avoid opening or analyzing capture files from untrusted or unknown sources until patching is complete. Release notes for the patched version are available at the Wireshark website (Wireshark Advisory, Wireshark 4.6.5 Release Notes).

The Wireshark Foundation announced the release of version 4.6.5 addressing this and approximately 40 other vulnerabilities via the wireshark-announce mailing list in April 2026, with a follow-up announcement in May 2026 (Wireshark Announce). Security news outlets including CyberSecurityNews and Cryptika covered the broader Wireshark 4.6.5 release, with some headlines emphasizing remote code execution risks from other CVEs in the same release batch (CyberSecurityNews). Linux distribution security teams, including Debian and SUSE, issued advisories and package updates incorporating the fixes (LinuxSecurity).