Skip to main content

Wireshark CVE-2026-5657

| EUVDEUVD-2026-26326 MEDIUM
Double Free (CWE-415)
2026-04-30 GitLab
Denial Of Service Red Hat Wireshark Suse Wireshark Foundation
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Patch released
May 01, 2026 - 16:45 nvd
Patch available
Patch available
Apr 30, 2026 - 08:16 EUVD
Analysis Generated
Apr 30, 2026 - 06:47 vuln.today
EUVD ID Assigned
Apr 30, 2026 - 06:30 euvd
EUVD-2026-26326
Analysis Generated
Apr 30, 2026 - 06:30 vuln.today
CVE Published
Apr 30, 2026 - 05:38 nvd
MEDIUM 5.5

DescriptionCVE.org

iLBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

AnalysisAI

Denial of service in Wireshark 4.6.0-4.6.4 and 4.4.0-4.4.14 via crafted iLBC codec packets allows local attackers with user interaction to crash the application and interrupt service. The vulnerability stems from a use-after-free condition in the iLBC codec parser, triggered when Wireshark processes malformed audio codec data, causing an application crash without code execution.

Technical ContextAI

Wireshark is a network protocol analyzer that dissects captured traffic by parsing codec implementations, including the iLBC (Internet Low Bitrate Codec) used in VoIP. The iLBC dissector in affected versions contains a use-after-free vulnerability (CWE-415), where memory is accessed after being deallocated. This occurs during the parsing of iLBC audio frames embedded in network packets. When a specially crafted iLBC codec packet is processed, the parser attempts to dereference freed memory, leading to a segmentation fault or application crash. The CPE cpe:2.3:a:wireshark_foundation:wireshark:*:*:*:*:*:*:*:* indicates all Wireshark installations of the affected versions are vulnerable if iLBC dissection is enabled.

RemediationAI

Upgrade to Wireshark 4.6.5 or later (for the 4.6.x branch) or to Wireshark 4.4.15 or later (for the 4.4.x branch) to obtain the patched iLBC dissector. Users unable to upgrade immediately should avoid opening untrusted PCAP files or network captures containing iLBC codec data in Wireshark. If live packet analysis is required on untrusted networks, restrict capture filters to exclude VoIP protocols (e.g., disable SIP/RTP dissection) to bypass iLBC parsing. Disable the iLBC dissector in Wireshark's protocol preferences if VoIP analysis is not required. Patch details and download links are available at https://www.wireshark.org/security/wnpa-sec-2026-20.html.

More in Wireshark

View all
CVE-2014-2299 CRITICAL POC
9.3 Mar 11

Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10
CVE-2013-4074 MEDIUM POC
5.0 Jun 09

The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.
CVE-2018-6836 CRITICAL POC
9.8 Feb 08

The netmonrec_comment_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an un
CVE-2014-4174 CRITICAL POC
9.3 Jun 18

wiretap/libpcap.c in the libpcap file parser in Wireshark 1.10.x before 1.10.4 allows remote attackers to execute arbitr
CVE-2017-9353 HIGH POC
7.5 Jun 02

In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. Rated high severity (CVSS 7.5), this vulnerability is remot
CVE-2017-17085 HIGH POC
7.5 Dec 01

In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. Rated high severity (CVSS 7.5), t
CVE-2017-9347 HIGH POC
7.5 Jun 02

In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. Rated high severity (CVSS 7.
CVE-2025-5601 HIGH POC
7.8 Jun 04

A denial of service vulnerability in Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 (CVSS 7.8)

CVE-2023-4513 HIGH POC
7.5 Aug 24

BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injecti
CVE-2023-4512 HIGH POC
7.5 Aug 24

CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file.

CVE-2023-2879 HIGH POC
7.5 May 26

GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or cra
CVE-2023-1992 HIGH POC
7.5 Apr 12

RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection o

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Fixed

Share

CVE-2026-5657 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy