Wireshark CVE-2026-5403

Exploitation requires the target user to open a malicious packet capture file in Wireshark and the SBC codec dissector to process Bluetooth traffic within that capture. The vulnerability is triggered specifically when the SBC (Sub-Band Codec) parser encounters crafted audio codec data, meaning captures must contain Bluetooth protocol layers or the attacker must structure the PCAP to invoke SBC dissection. User interaction is mandatory (UI:R in CVSS vector) - passive network monitoring does not trigger the vulnerability; the analyst must actively load the file. No authentication is required (PR:N), so any user with Wireshark installed can be targeted regardless of privilege level. The local attack vector (AV:L) limits exploitation to scenarios where the attacker can deliver a file to the target system through email attachments, shared drives, USB media, web downloads, or social engineering, rather than exploiting over the network remotely.

The CVSS v3.1 score of 7.8 (HIGH) reflects significant potential impact with full confidentiality, integrity, and availability compromise possible. However, the attack vector is LOCAL (AV:L) requiring user interaction (UI:R), which substantially limits practical exploitation compared to network-based vulnerabilities. The attack complexity is LOW (AC:L) and requires no privileges (PR:N), meaning any user who can open a malicious capture file is at risk. Real-world risk centers on social engineering scenarios where analysts are tricked into opening weaponized PCAP files from emails, file shares, or untrusted sources. Security teams processing captures from adversarial networks (incident response, malware analysis, threat hunting) face elevated risk. The scope is UNCHANGED (S:U), meaning exploitation is confined to the Wireshark process context, limiting lateral movement potential. Without EPSS data or KEV listing, exploitation likelihood assessment relies on attack surface: Wireshark's widespread use in security operations makes it an attractive target, but the local-only vector and user interaction requirement reduce the probability of mass exploitation compared to remotely exploitable network services. GitLab issue tracker reference suggests vulnerability was responsibly disclosed through Wireshark's development process.

An attacker crafts a malicious PCAP file containing specially formatted Bluetooth SBC codec frames designed to trigger the heap overflow when parsed. The file is delivered to a target network analyst via phishing email disguised as legitimate network evidence or posted to a file-sharing service with enticing filename like 'suspected_data_exfiltration.pcapng'. When the analyst opens the file in vulnerable Wireshark versions, the SBC dissector processes the malformed codec data, overflowing a heap buffer and allowing the attacker to execute arbitrary code with the analyst's privilege level, potentially compromising sensitive network captures, investigation data, or establishing persistence on the analyst workstation.