CVE-2026-6867: 
Wireshark vulnerability analysis and mitigation

CVE-2026-6867 is a denial-of-service vulnerability in the SMB2 protocol dissector of Wireshark caused by improperly controlled sequential memory allocation (CWE-1325). It affects Wireshark versions 4.4.0 through 4.4.14 and 4.6.0 through 4.6.4. The vulnerability was published on April 30, 2026, with patches made available the same day. It carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Wireshark Advisory).

The root cause is an improperly controlled sequential memory allocation flaw (CWE-1325) in Wireshark's SMB2 protocol dissector. The vulnerability is specifically triggered by chained PATTERN_V1 decompression processing — a "decompression bomb" technique — where crafted SMB2 packets cause unbounded sequential memory allocations that crash the application. Exploitation requires local access and user interaction, such as opening a malicious packet capture file or processing a crafted packet stream. The attack is mapped to CAPEC-130 (Excessive Allocation) and MITRE ATT&CK technique T1499.003 (Application Exhaustion Flood) (GitHub Advisory, Wireshark GitLab).

Successful exploitation causes Wireshark to crash, resulting in a denial of service that disrupts network analysis and troubleshooting workflows. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. Because Wireshark is a passive analysis tool rather than a network service, the blast radius is confined to the local workstation running the affected version; lateral movement or data exfiltration are not applicable consequences (GitHub Advisory, Wireshark Advisory).

A proof-of-concept issue report exists on the Wireshark GitLab issue tracker (work item #21191), but it does not contain functional exploit code or reproduction steps (Wireshark GitLab). There is no evidence of active in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (2nd percentile), indicating a very low probability of exploitation in the near term (GitHub Advisory).

1. Craft a malicious capture file: Create a packet capture (.pcap/.pcapng) file containing crafted SMB2 packets that use chained PATTERN_V1 decompression structures designed to trigger excessive sequential memory allocation (a decompression bomb).
2. Deliver the file to the target: Social-engineer a Wireshark user into opening the malicious capture file, or place it in a location the user is likely to open (e.g., shared network drive, email attachment).
3. Trigger dissector processing: When the victim opens the file in a vulnerable Wireshark version (4.4.0–4.4.14 or 4.6.0–4.6.4), the SMB2 dissector processes the crafted packets and begins sequential memory allocations without proper bounds checking.
4. Achieve denial of service: The unbounded memory allocation exhausts available resources, causing Wireshark to crash and become unavailable (Wireshark GitLab, GitHub Advisory).

• File System: Presence of unexpected or externally sourced .pcap or .pcapng files containing SMB2 traffic with PATTERN_V1 compression chains; files delivered via email, messaging, or shared drives from untrusted sources.
• Process: Wireshark process (wireshark.exe or wireshark) terminating unexpectedly or generating crash dumps/core dumps shortly after opening a capture file containing SMB2 traffic.
• Logs: Application crash reports or Windows Error Reporting (WER) entries referencing Wireshark process termination; system event logs showing abnormal memory consumption by the Wireshark process prior to crash.

Users should upgrade Wireshark to version 4.4.15 or later (for the 4.4.x branch) or version 4.6.5 or later (for the 4.6.x branch) to remediate this vulnerability (Wireshark Advisory). As an interim workaround until patching is possible, users should avoid opening packet capture files from untrusted or unknown sources, and organizations should implement controls restricting the processing of externally sourced capture files. Nessus detection plugins (IDs 311230, 313009, and 318251) are available to identify vulnerable installations (GitHub Advisory).

Coverage of CVE-2026-6867 has been limited to automated vulnerability tracking feeds, CVE aggregators, and scanner vendor updates (Tenable/Nessus). A Debian security advisory (DSA-6249-1) was issued covering Wireshark, and Linux security news outlets reported on the update. No notable independent researcher commentary or significant social media discussion beyond automated CVE notification accounts has been observed for this moderate-severity vulnerability.