Description
DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Published: 2026-04-30
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Wireshark’s DCP-ETSI protocol dissector contains a heap‑based buffer overflow (CWE‑122) and a null pointer dereference (CWE‑476) that can be triggered with a specially crafted packet capture file, causing the application to crash. The flaw results in denial of service, preventing a user from using Wireshark to analyze traffic. The impact is limited to the local process and does not expose data, but it can disrupt workflows that rely on the tool.

Affected Systems

The vulnerability affects Wireshark Foundation’s Wireshark product in versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. No other Wireshark releases or third‑party products are known to be impacted.

Risk and Exploitability

With a CVSS score of 5.5, the flaw is moderate in severity. The EPSS score is 0.00017 (less than 1%), indicating a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is the execution of a crafted DCP‑ETSI packet capture by a user opening the file in Wireshark, which is generally a local, user‑initiated action. Exploitation requires that the attacker can supply the file to a user running the affected version of Wireshark.

Generated by OpenCVE AI on May 4, 2026 at 13:54 UTC.

Remediation

Vendor Solution

Upgrade to version 4.6.5 or above

OpenCVE Recommended Actions

  • Upgrade Wireshark to version 4.6.5 or later to remove the buffer overflow and null pointer dereference
  • If upgrading is not immediately feasible, avoid opening untrusted packet capture files that may contain DCP‑ETSI traffic or run Wireshark in a sandboxed environment to contain potential crashes
  • Validate that captured files are from trusted sources and consider using content filtering to block suspicious DCP‑ETSI packets before opening them

Generated by OpenCVE AI on May 4, 2026 at 13:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6249-1 wireshark security update
History

Mon, 04 May 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 01 May 2026 17:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*

Thu, 30 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Apr 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Wireshark
Wireshark wireshark
Vendors & Products Wireshark
Wireshark wireshark

Thu, 30 Apr 2026 06:30:00 +0000

Type Values Removed Values Added
Description DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Title Heap-based Buffer Overflow in Wireshark
Weaknesses CWE-122
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Wireshark Wireshark
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-04-30T12:51:06.316Z

Reserved: 2026-04-06T06:33:52.597Z

Link: CVE-2026-5653

cve-icon Vulnrichment

Updated: 2026-04-30T12:51:02.831Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-30T07:16:38.520

Modified: 2026-05-01T17:04:57.713

Link: CVE-2026-5653

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-30T05:38:49Z

Links: CVE-2026-5653 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-04T14:00:20Z

Weaknesses