Wireshark TLS Dissector Heap Overflow CVE-2026-5402: Brief Summary of a High Severity Analyst Risk

Introduction

A heap buffer overflow in Wireshark's TLS dissector exposes the people who use the tool for network forensics and incident response. Analysts face denial of service or code execution on their own workstations. The flaw is tracked as CVE-2026-5402, has a CVSS 3.1 base score of 8.8, and sits in the Encrypted Client Hello (ECH) transcript reconstruction code. Capturing malicious traffic or opening a crafted packet capture file is enough to trigger it.

Technical information

The vulnerability is in Wireshark's TLS protocol dissector, in the code that reconstructs Encrypted Client Hello (ECH) transcripts. It is classified as CWE-122 (Heap-based Buffer Overflow), with CWE-680 (Integer Overflow to Buffer Overflow) and CWE-197 (Numeric Truncation Error) as additional weaknesses.

Root cause

The bug is an integer truncation error in the ech_outer_extensions processing loop. When Wireshark parses a TLS ClientHello packet that contains crafted ECH outer extensions, it truncates a numeric value. The dissector then miscalculates a buffer boundary and writes attacker-controlled data past the end of a heap-allocated buffer. Security researcher Duc Anh Nguyen confirmed with AddressSanitizer that the overflow is exactly 245 bytes.

The three CWEs describe a classic chain. A numeric truncation (CWE-197) causes an integer overflow that leads to a buffer overflow (CWE-680), and that overflow lands on the heap (CWE-122). An arithmetic error in a size calculation ends in memory corruption.

Attack flow

Exploiting the flaw requires no authentication and no direct access to the victim's system. An attacker can trigger it in two ways, and both fit closely with what analysts do every day.

Vector 1: Malicious live traffic

1. The attacker crafts a TLS ClientHello packet with malicious ECH outer extensions designed to trigger the integer truncation.
2. The attacker injects the packet onto a network segment that the target analyst is monitoring.
3. The analyst's Wireshark instance captures and dissects the packet, and the ech_outer_extensions processing loop hits the truncation error.
4. The dissector writes 245 bytes of attacker-controlled data past the heap buffer boundary. The result is a crash or, potentially, arbitrary code execution.

Vector 2: Crafted capture file

1. The attacker builds a pcapng (or similar format) capture file that contains the malicious TLS ClientHello packet.
2. The attacker gets the file to the target analyst through social engineering, a shared repository, or a supply-chain compromise.
3. The analyst opens the file in a vulnerable Wireshark version, which runs the same dissector code path.
4. The heap overflow happens during file parsing, with the same possible outcomes: a crash or code execution.

Both vectors are concerning because security analysts routinely capture live traffic from untrusted networks and open capture files from external sources during investigations.

Affected systems and versions

CVE-2026-5402 affects the following Wireshark versions:

Versions 4.4.x and earlier are safe because they do not contain the ECH decryption code where the flaw lives. The bug arrived with the ECH transcript reconstruction feature in the 4.6.x branch.

If you cannot upgrade to 4.6.5 right away, you can use the maintained 4.4.x branch to analyze untrusted captures as a temporary workaround.

Vendor security history

Wireshark runs an open, active security advisory process. The software parses hundreds of complex network protocols, and much of that input is malformed, so dissector vulnerabilities come up again and again. The 4.6.5 release that fixes CVE-2026-5402 also fixes several other security issues:

Shipping several security fixes in one release follows from how hard protocol parsing is, and it also shows the project fixes reported issues promptly. More than 2000 authors have contributed to Wireshark, and publications including PC Magazine and InfoWorld have given it awards.

References

• CVE-2026-5402 Detail, National Vulnerability Database
• Wireshark Security Advisory wnpa-sec-2026-14
• GitLab Issue #21090: Heap buffer overflow in TLS ECH transcript reconstruction
• Wireshark Security Advisories Index
• Wireshark Official Site
• Wireshark, Wikipedia