Zero Day Initiative Discloses Wireshark Integer Overflow Vulnerability Enabling Remote Code Execution
A critical integer overflow in Wireshark's LBMC fragment reassembly feature allows unauthenticated attackers to execute arbitrary code remotely.
The Zero Day Initiative (ZDI) has publicly disclosed a critical remote code execution (RCE) vulnerability, tracked as ZDI-26-899, affecting the widely-used network protocol analyzer, Wireshark. This flaw resides within the LBMC fragment reassembly functionality and can be exploited by unauthenticated attackers to achieve arbitrary code execution on vulnerable systems.
The vulnerability stems from an integer overflow condition that occurs due to insufficient validation of user-supplied data during the LBMC fragment reassembly process. When this data is processed, the overflow can lead to memory corruption, which an attacker can then leverage to overwrite critical data structures and inject malicious code. Successful exploitation allows an attacker to execute commands with the same privileges as the Wireshark process itself.
While the vulnerability is critical, its exploitation is contingent on the LBMC fragment reassembly feature being enabled within the affected Wireshark installation. This specific configuration might limit the overall attack surface, but for systems where it is active, the risk is significant. The vulnerability has been assigned a CVSS score of 7.5, indicating a high severity.
Wireshark developers have already addressed this vulnerability by releasing patches. Fixes are available in Wireshark version 4.6, with a specific commit noted at https://gitlab.com/wireshark/wireshark/-/commit/4d1c6d964c7c0c7a59b0afc14a8e44d5d831ab73. Additionally, version 4.4 has also been patched, with the relevant commit available at https://gitlab.com/wireshark/wireshark/-/commit/e2f9595e3d6beaf31344f5de745b0ff4d041bd82. Users are strongly advised to update to the patched versions as soon as possible to mitigate the risk.
The vulnerability was initially reported to the vendor on August 20, 2026. Following a coordinated disclosure process, ZDI published the advisory on November 10, 2026, with an update to the advisory also occurring on the same date. The discovery and reporting of this flaw are credited to HeeChan Kim, who operates under the alias '@heegong123' as part of TeamH4C.
This disclosure highlights the ongoing challenges in securing complex software like network analyzers. Vulnerabilities in tools that inspect network traffic can be particularly dangerous, as they often operate with high privileges and are prime targets for attackers seeking to gain a foothold in a network or exfiltrate sensitive data. The nature of this RCE vulnerability, requiring a specific feature to be enabled, underscores the importance of security configuration management alongside timely patching.
Users of Wireshark should ensure their installations are up-to-date, paying close attention to the specific versions patched. For those who rely on LBMC fragment reassembly, immediate action is recommended. This vulnerability serves as a reminder that even widely-used and trusted security tools can harbor critical flaws that require diligent security practices to manage.