CVE-2026-5403
Published: 01 May 2026
Summary
CVE-2026-5403 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Wireshark Wireshark. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 1.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely patching and remediation of the heap-based buffer overflow vulnerability in Wireshark's SBC codec dissector as advised in WNPA-SEC-2026-16.
Provides memory protections like ASLR and DEP to mitigate exploitation of heap-based buffer overflows leading to denial of service or code execution.
Mandates validation of packet capture file inputs to Wireshark dissectors, addressing the root cause of buffer overflows from malformed SBC codec data.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The heap-based buffer overflow vulnerability in the Wireshark SBC codec dissector enables code execution (or DoS) when a user opens a malicious packet capture file, directly mapping to Exploitation for Client Execution.
NVD Description
SBC codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution
Deeper analysisAI
CVE-2026-5403 affects the SBC codec dissector in Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. The vulnerability causes a crash due to heap-based buffer overflows (CWE-122 and CWE-787), enabling denial of service and possible code execution. Published on 2026-05-01, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
An attacker with local access can exploit this vulnerability with low complexity and no required privileges, but it necessitates user interaction, such as convincing a Wireshark user to open a malicious packet capture file. Successful exploitation leads to denial of service through application crashes or potential code execution, resulting in high impacts to confidentiality, integrity, and availability on the local system.
For mitigation guidance and patches, refer to the Wireshark security advisory WNPA-SEC-2026-16 at https://www.wireshark.org/security/wnpa-sec-2026-16.html and the related GitLab issue tracker at https://gitlab.com/wireshark/wireshark/-/issues/21103.
Details
- CWE(s)