Wireshark CVE-2026-5402

Exploitation requires the victim to actively open a malicious packet capture file or perform live capture/inspection of attacker-controlled network traffic containing crafted TLS protocol data using Wireshark 4.6.0 through 4.6.4. The TLS protocol dissector must be enabled in Wireshark (default configuration), and the user must navigate to or scroll through the capture to trigger parsing of the malicious TLS packets. Attack success does not depend on non-default Wireshark configurations or specific TLS analysis preferences. Exploitation is limited by the user interaction requirement (CVSS UI:R) - automated remote exploitation without victim action is not possible. No authentication to Wireshark or the victim system is required (PR:N). The vulnerability affects all platforms (Windows, Linux, macOS) running affected versions. Most susceptible targets are security operations centers, incident response teams, network troubleshooting environments, and malware analysis labs where analysts routinely process packet captures from untrusted or adversarial sources.

Real-world risk assessment reveals moderate-to-high priority requiring prompt action. The CVSS 8.8 score accurately reflects severe potential impact (complete confidentiality, integrity, and availability compromise via C:H/I:H/A:H), but the UI:R (user interaction required) constraint significantly limits automated exploitation scenarios. Attackers must social-engineer targets into opening malicious packet capture files or inspecting attacker-controlled network traffic, making this unsuitable for worm-like propagation. No EPSS score provided in input data, and no CISA KEV listing indicates this is not yet confirmed as actively exploited in the wild. The AV:N vector means exploit delivery via remote channels (email attachments, malicious downloads, compromised analysis environments), while AC:L confirms the attack is reliable once user interaction occurs. Primary risk surfaces include security analysts examining suspicious traffic, network engineers troubleshooting issues, or researchers analyzing shared capture files from untrusted sources. The combination of high impact and moderate likelihood makes this a priority patch candidate for organizations using Wireshark, especially in SOC/NOC environments where analysts routinely open third-party captures.

An attacker crafts a malicious PCAP file containing specially formatted TLS handshake packets designed to trigger the heap overflow when parsed by Wireshark's TLS dissector. The attacker distributes this file via email to security analysts with a subject line like 'Suspicious encrypted traffic from incident #7234 - please analyze' or uploads it to file-sharing platforms frequented by network professionals. When a victim opens the file in Wireshark 4.6.0-4.6.4, the TLS dissector processes the malformed packets, overflowing heap memory and potentially executing attacker-controlled code with the privileges of the Wireshark process, allowing system compromise or lateral movement within the analyst's network environment.