The Network Mirror Is the Weapon: Wireshark 4.6.5 Patches 40+ Critical Vulnerabilities Including Remote Code Execution

TL;DR

Wireshark, the world's most widely deployed open-source packet analyzer, released critical security patch 4.6.5 addressing 40+ vulnerabilities, including four remote code execution flaws that allow arbitrary code execution via malformed packets or malicious capture files. The flaw categories span protocol dissectors (TLS, RDP, SBC), infinite loops, DoS crashes, and core decompression engine failures—all exploitable by attackers on the same network segment with zero authentication.

What Happened

Wireshark Foundation released patch version 4.6.5 on May 3, 2026, addressing a critical batch of vulnerabilities discovered at scale. The vulnerability set includes:

• 4 Remote Code Execution flaws (CVE-2026-5402, 5403, 5405, 5656) with crash-plus-execution potential in TLS dissector, SBC codec, RDP dissector, and profile import handlers
• 20+ Denial-of-Service crashes across protocol dissectors (Monero, FC-SWILS, ICMPv6, AFP, K12 RF5, AMR-NB, SDP, iLBC, DCP-ETSI, BEEP, ZigBee, Kismet, ASN.1 PER, RTSP, 802.11, MySQL, GSM RP, WebSocket, HTTP)
• 6 Infinite-loop / resource exhaustion flaws (SMB2, DLMS/COSEM, USB HID, SANE, OpenFlow v5/v6, MBIM, RPKI-Router) enabling sustained denial-of-service
• 2 Decompression engine vulnerabilities (zlib, LZ77) affecting any protocol using compressed payloads

Technical Details

Code Execution Attack Chain

The RCE flaws are particularly dangerous when Wireshark processes untrusted traffic:

1. TLS Dissector (CVE-2026-5402): Malformed TLS packet causes crash + possible code execution in dissection pipeline

2. SBC Audio Codec (CVE-2026-5403): Crafted SBC audio data triggers parser crash with execution

3. RDP Dissector (CVE-2026-5405): Adversarial Remote Desktop Protocol packets exploit parser logic

4. Profile Import (CVE-2026-5656): Malicious profile file loaded during import execution context

Attack Vector:

• Network injection (same segment)
• Malicious .pcapng file in SMB/FTP share
• Compromised SIEM export feed
• Captured traffic file from untrusted source
• No authentication required

Denial-of-Service via Dissector Crashes

20+ protocol parsers are vulnerable to crash-triggered DoS:

• Single malformed packet → Wireshark hang
• In automated capture pipelines, permanently halts analysis
• Affected protocols span: Monero, AFP, ZigBee, MySQL, HTTP, RTSP, 802.11, SDP

Infinite-Loop Resource Exhaustion

SMB2, TLS, OpenFlow, MBIM dissectors can be forced into infinite loops via specific packet sequences, consuming CPU indefinitely. In SIEM contexts, this can cascade to halt entire monitoring infrastructure.

Engine-Level Decompression Collapse

zlib and LZ77 decompression flaws (CVE-2026-6535, CVE-2026-6533) affect any compressed protocol, expanding the attack surface beyond individual dissectors. A single malformed zlib payload can corrupt the dissection engine's state.

Lyrie Assessment

This vulnerability batch is a network defender's nightmare because Wireshark occupies a critical trust boundary:

1. Privilege Escalation Path: Wireshark is routinely run with elevated privileges in SOC, forensics, and live-capture contexts. Successful RCE = full system compromise.

2. Supply Chain Vector: If Wireshark is running on shared network monitoring infrastructure, a single compromised network segment can own the entire monitoring stack.

3. AI-Assisted Discovery Signal: The Wireshark team credits "AI-assisted vulnerability reporting" for this batch's speed and breadth. This is a pattern we're seeing across open-source projects: AI vulnerability scanners find distributed weaknesses faster than patches ship. This is no longer a theoretical threat—it's operationalized.

4. The Dissector Explosion Problem: Wireshark's architecture (50+ built-in dissectors) means each protocol parser is a potential exploit surface. Attackers no longer need to find one weakness—they can choose from 40+.

5. Autonomous Defense Implication: For Lyrie's audience, this matters because network traffic analysis is a critical detection layer. If your SIEM's Wireshark instances are unpatched and accepting traffic from untrusted sources (IoT, guest networks, cloud feeds), you have an RCE vulnerability in your detection infrastructure.

Recommended Actions

1. Immediate (24 hours):

- Audit all systems running Wireshark: SOC appliances, packet capture tools, forensics workstations, SIEM collectors

- Identify which systems have network-accessible Wireshark services or process untrusted .pcapng files

- Pull current Wireshark version (wireshark --version)

2. Critical (48 hours):

- Upgrade to Wireshark 4.6.5 or later on all systems

- Segment network traffic flows: untrusted capture sources should be isolated from monitoring infrastructure

- Implement file-level isolation: restrict which users can import .pcapng files

3. Defensive:

- Monitor for Wireshark crashes in logs (potential exploit attempt)

- Implement process isolation: run Wireshark in containers or VMs when processing untrusted traffic

- Consider running older, stable Wireshark versions (3.x) in read-only mode for legacy systems

4. Detection:

- Hunt for malformed TLS, RDP, SBC traffic in logs (RCE attempt indicators)

- Monitor for unexpected Wireshark restarts on SOC infrastructure

- Alert on unusual dissector CPU usage (infinite-loop attacks)

Sources

1. Cybersecurity News: Critical Wireshark Vulnerabilities

2. Wireshark Official Release Notes (4.6.5)

---

Lyrie.ai Cyber Research Division