Critical Wireshark Vulnerabilities Let Attackers Execute Arbitrary Code Via Malformed Packets
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Wireshark<\/a>, the world\u2019s most widely used open-source network protocol analyzer, has released a major security update addressing over 40 vulnerabilities, several of which enable arbitrary code execution through malformed packet injection or malicious capture files.<\/p>\n Organizations and individuals relying on Wireshark for network monitoring, forensics, and traffic analysis should update immediately to Wireshark 4.6.5.<\/p>\n The most severe vulnerabilities in this release carry the potential for remote code execution (RCE), moving beyond simple denial-of-service impact. Four dissectors and parsers were found susceptible:<\/p>\n These vulnerabilities are particularly dangerous because Wireshark is routinely run with elevated privileges in enterprise and SOC environments<\/a>, meaning successful exploitation could grant attackers significant system access.<\/p>\n A large portion of the patched flaws cause application crashes when specific protocol dissectors process malformed or adversarially crafted packets. Affected dissectors span a wide range of protocols:<\/p>\n An attacker on the same network segment can trigger these crashes by injecting specially crafted packets, requiring no authentication or prior access to the target system.<\/p>\n Several vulnerabilities cause infinite loops, effectively hanging Wireshark and consuming system resources in a sustained denial-of-service condition:<\/p>\n These loop-based flaws are especially problematic in automated traffic capture pipelines where Wireshark runs unattended, as a single malformed packet can permanently halt analysis.<\/p>\n Two low-level vulnerabilities target Wireshark\u2019s core dissection engine rather than individual protocol parsers:<\/p>\n These engine-level flaws affect any protocol using compressed payloads, substantially broadening the attack surface beyond specific protocol dissectors.<\/p>\nCritical Code Execution Flaws<\/strong><\/h2>\n
\n
Denial-of-Service via Dissector Crashes<\/strong><\/h2>\n
\n
Infinite Loop and Resource Exhaustion<\/strong><\/h2>\n
\n
Decompression Engine Vulnerabilities<\/strong><\/h2>\n
\n
Affected Versions & Remediation<\/strong><\/h2>\n