CVE-2026-5653
Published: 30 April 2026
Summary
CVE-2026-5653 is a medium-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Wireshark Wireshark. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the buffer error (CWE-122) in Wireshark's DCP-ETSI dissector by requiring timely patching of affected versions to prevent DoS crashes from crafted pcap files.
Enables detection of the vulnerability in deployed Wireshark instances through vulnerability scanning of applications and systems.
Provides awareness of Wireshark advisories like WNPA-SEC-2026-22 to prompt remediation of the DoS vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability in Wireshark file parser causes crash on crafted PCAP (CWE-122), directly enabling malicious file delivery for user execution (T1204.002) and application exploitation for endpoint DoS (T1499.004).
NVD Description
DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Deeper analysisAI
CVE-2026-5653 is a vulnerability in the DCP-ETSI protocol dissector within Wireshark versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. It causes a crash that enables denial of service, stemming from CWE-122. The issue was published on 2026-04-30 and carries a CVSS v3.1 base score of 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
An attacker with local access can exploit this vulnerability by tricking a user into opening a specially crafted packet capture file in Wireshark. No privileges are required, but user interaction is necessary, and the attack has low complexity. Successful exploitation results in a denial of service through application crash, with no impact on confidentiality or integrity.
Wireshark's security advisory WNPA-SEC-2026-22, along with related GitLab issues and work items, provides details on the flaw. Security practitioners should consult these references for patch information and mitigation guidance.
Details
- CWE(s)