CVE-2026-5654
Published: 30 April 2026
Summary
CVE-2026-5654 is a medium-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Wireshark Wireshark. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 5.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2026-5654 by requiring timely installation of Wireshark patches that fix the AMR-NB codec stack buffer overflow.
Requires monitoring and dissemination of security advisories like Wireshark's WNPA-SEC-2026-18 to identify and address the vulnerable AMR-NB codec versions.
Enables scanning for CVE-2026-5654 to identify systems running affected Wireshark versions 4.6.0-4.6.4 or 4.4.0-4.4.14.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability triggered by opening malicious capture file with crafted AMR-NB data (T1204.002) leading to application crash via stack buffer overflow exploitation for DoS (T1499.004).
NVD Description
AMR-NB codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Deeper analysisAI
CVE-2026-5654 is a vulnerability in the AMR-NB codec implementation within Wireshark, affecting versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. The flaw, classified under CWE-121 (stack-based buffer overflow), triggers a crash when processing malformed AMR-NB audio data, resulting in a denial-of-service condition. Published on April 30, 2026, it carries a CVSS v3.1 base score of 5.5, reflecting medium severity due to its local attack vector and high availability impact.
Exploitation requires local access to the target system with no privileges (PR:N), low complexity (AC:L), and user interaction (UI:R), such as convincing a user to open a malicious capture file containing crafted AMR-NB data in Wireshark. Successful exploitation causes the application to crash, disrupting network analysis workflows but with no impact on confidentiality or integrity (C:N/I:N), limited to the unsynchronized scope (S:U), and high availability disruption (A:H).
Wireshark's security advisory WNPA-SEC-2026-18 and related GitLab issues (21111) detail the issue and recommend mitigation through updating to patched versions beyond the affected ranges. Practitioners should consult these resources for specific fixed releases and verify installations to prevent crashes from malformed files.
Details
- CWE(s)