Description
ZigBee protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Published: 2026-04-30
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Wireshark’s ZigBee protocol dissector contains a stack-based buffer overflow that can be triggered by processing malicious ZigBee packets. When the overflow occurs, the Wireshark process crashes, effectively denying service to the user. The weakness is a stack-based buffer overflow (CWE-121) and also involves an input validation flaw (CWE-617).

Affected Systems

The vulnerability affects Wireshark Foundation’s Wireshark product. Versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14 are impacted. An upgrade to 4.6.5 or later resolves the issue.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score is <1%, indicating a very low exploitation probability, but not zero. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that Wireshark process ZigBee traffic, so an attacker would need to supply crafted packets or a capture file to a user running Wireshark. The impact is limited to a crash of the application, but repeated crashes could disrupt analysis workflows.

Generated by OpenCVE AI on May 4, 2026 at 13:55 UTC.

Remediation

Vendor Solution

Upgrade to version 4.6.5 or above

OpenCVE Recommended Actions

  • Upgrade Wireshark to version 4.6.5 or later to apply the vendor fix.
  • If an upgrade is not immediately possible, temporarily disable the ZigBee dissector plugin or remove the ZigBee module so that malicious packets are not processed.
  • Avoid opening untrusted capture files or streams containing ZigBee traffic until a fix or safe configuration is applied.

Generated by OpenCVE AI on May 4, 2026 at 13:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6249-1 wireshark security update
History

Mon, 04 May 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-617
References
Metrics threat_severity

None

 threat_severity

Moderate

Fri, 01 May 2026 18:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*

Thu, 30 Apr 2026 13:15:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 30 Apr 2026 08:00:00 +0000

Type Values Removed Values Added
First Time appeared Wireshark
Wireshark wireshark
Vendors & Products Wireshark
Wireshark wireshark

Thu, 30 Apr 2026 06:30:00 +0000

Type Values Removed Values Added
Description ZigBee protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Title Stack-based Buffer Overflow in Wireshark
Weaknesses CWE-121
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

Subscriptions

Wireshark Wireshark
cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published:

Updated: 2026-04-30T12:49:48.987Z

Reserved: 2026-04-17T15:06:37.698Z

Link: CVE-2026-6537

cve-icon Vulnrichment

Updated: 2026-04-30T12:49:45.816Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-30T07:16:41.103

Modified: 2026-05-01T18:15:45.017

Link: CVE-2026-6537

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-04-30T05:37:59Z

Links: CVE-2026-6537 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-05-04T14:00:20Z

Weaknesses