Wireshark Vulnerability Allows Remote Code Execution via SMB Export Flaw
A critical integer overflow in Wireshark's SMB object export functionality allows remote attackers to execute arbitrary code with user interaction.
A significant remote code execution vulnerability, identified as ZDI-26-900, has been disclosed in the widely-used network protocol analyzer, Wireshark. The flaw stems from an integer overflow within the functionality responsible for exporting Server Message Block (SMB) objects from captured network traffic. This vulnerability, assigned a high severity CVSS score of 8.8 by the Zero Day Initiative (ZDI), requires user interaction for successful exploitation, typically involving the opening of a specially crafted capture file.
The core of the vulnerability lies in the improper validation of user-supplied data during the SMB object export process. This oversight allows an attacker to trigger an integer overflow condition before data is written to memory. Successful exploitation could enable an attacker to execute arbitrary code within the context of the running Wireshark process, potentially leading to further compromise of the affected system.
While user interaction is a prerequisite, the nature of Wireshark's use in analyzing network traffic means that users may inadvertently open malicious capture files shared through various channels. This makes the vulnerability a considerable risk for security professionals, network administrators, and anyone who relies on Wireshark for network analysis and troubleshooting.
The Zero Day Initiative reported the vulnerability on September 10, 2026, and coordinated with the vendor for a public release of the advisory on November 10, 2026. This timeline allowed for the development and distribution of patches to mitigate the risk.
Wireshark has addressed this vulnerability through updates. Specifically, versions 4.6 and 4.4 have received fixes. Developers can find the relevant code commits on GitLab, with the fix for version 4.6 available at https://gitlab.com/wireshark/wireshark/-/commit/bf270c79258480c264296fe6f832cec2b3aecabb and for version 4.4 at https://gitlab.com/wireshark/wireshark/-/commit/bf4578f18e09536c8d8e939129e3c7ade3a5c8af.
Users are strongly advised to update their Wireshark installations to the patched versions as soon as possible to protect against potential exploitation. The disclosure highlights the ongoing need for vigilance in software security, particularly for tools that handle complex data formats and network protocols.
The vulnerability was discovered and reported by researcher Mirae. The coordinated disclosure ensures that users have access to patches before widespread exploitation can occur, though the possibility of zero-day exploitation always exists.