Wireshark LoRaWAN Decryption Flaw Allows Remote Code Execution
A numeric truncation error in Wireshark's LoRaWAN decryption functionality enables remote, unauthenticated attackers to execute arbitrary code on affected systems.
Security researchers at Zero Day Initiative have disclosed a critical vulnerability within the popular network protocol analyzer, Wireshark. The flaw, identified as ZDI-26-898, resides in the software's handling of LoRaWAN payload decryption and could allow unauthenticated, network-adjacent attackers to execute arbitrary code.
The vulnerability stems from an improper validation of user-supplied data during the decryption process. This oversight leads to an incorrect calculation before data is written into memory, creating a condition where an attacker can overwrite critical memory regions. Successful exploitation would grant the attacker code execution within the context of the Wireshark process, potentially leading to a full system compromise.
While the vulnerability is rated with a CVSS score of 7.1, indicating a high severity, its exploitability is limited to instances of Wireshark where LoRaWAN decryption is actively enabled. This specific functionality is crucial for analyzing LoRaWAN network traffic, but its presence makes these installations a target.
Developers have already addressed the issue. Commit logs indicate fixes have been integrated into Wireshark versions 4.6 and 4.4. Users are strongly advised to update their Wireshark installations to the latest patched versions to mitigate this risk. The vulnerability was initially reported to the vendor on August 20, 2026, with a coordinated public release of the advisory on November 10, 2026.
The discovery and responsible disclosure of this vulnerability are credited to HeeChan Kim, also known by their handle @heegong123, a researcher from TeamH4C. This incident highlights the ongoing need for rigorous security auditing of widely used network analysis tools, as flaws in such software can have significant implications for network security professionals.
Wireshark is an indispensable tool for network troubleshooting and analysis, used by security professionals worldwide. The potential for remote code execution, even in a specific configuration, underscores the importance of keeping such critical infrastructure software up-to-date and secure. Organizations relying on Wireshark for network monitoring should prioritize applying the available patches.