CVE-2026-15166
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
A vulnerability in the IEEE 802.11 protocol dissector in Wireshark causes a crash. Affected versions are 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16.
Risk Assessment
An attacker can send a crafted network packet, causing Wireshark to crash, which prevents network traffic analysis and may delay incident detection.
Recommendation
It is recommended to immediately upgrade Wireshark to version 4.6.7 or later (for the 4.6 branch) and 4.4.17 or later (for the 4.4 branch).
Other vulnerabilities in Wireshark
See all- CVE-2017-17997High
In Wireshark before version 2.2.12, the MRDISC dissector misuses a NULL pointer, causing the program to crash. This issue was addressed by validating an IPv4 address.
- CVE-2017-17935High
The File_read_line function in Wireshark up to version 2.2.11 does not properly strip ' ' characters, allowing remote attackers to cause application crashes via crafted packets that trigger the processing of an empty line.
- CVE-2017-17083High
In Wireshark versions 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the NetBIOS dissector could crash. This was addressed by ensuring that write operations are bounded by the beginning of a buffer.
- CVE-2017-13767High
In Wireshark versions 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSDP dissector could go into an infinite loop. This was addressed by adding length validation.
- CVE-2017-11410High
In Wireshark versions up to 2.0.13 and 2.2.x up to 2.2.7, the WBXML dissector could enter an infinite loop triggered by packet injection or a malformed capture file. This was addressed by adding validation of the relationships between indexes and lengths.
- CVE-2017-9766High
In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows remote attackers to cause a denial of service (stack exhaustion) in the dissect_IODWriteReq function.
- CVE-2017-9351High
In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. This was addressed by extracting the Vendor Class Identifier more carefully.
- CVE-2017-9345High
In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DNS dissector could go into an infinite loop. This was addressed by trying to detect self-referencing pointers.
- CVE-2017-9343High
In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the MSNIP dissector misuses a NULL pointer. This was addressed by validating an IPv4 address.
- CVE-2017-7748High
In Wireshark versions 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WSP dissector could enter an infinite loop, triggered by packet injection or a malformed capture file. This was addressed by adding a length check.
Original NVD description (English source)
IEEE 802.11 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service