Heap-based Buffer Overflow in Wireshark
Summary
| CVE | CVE-2026-5405 |
|---|---|
| State | PUBLISHED |
| Assigner | GitLab |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-05-01 00:16:24 UTC |
| Updated | 2026-07-15 01:16:41 UTC |
| Description | RDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from ADP
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.000060000 probability, percentile 0.004470000 (date 2026-05-05)
Problem Types: CWE-122 | CWE-787 | CWE-122 CWE-122: Heap-based Buffer Overflow | CWE-122 Heap-based Buffer Overflow
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | ADP | CVSS | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | [email protected] | Secondary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | Secondary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| 3.1 | CNA | CVSS | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Wireshark Foundation | Wireshark | affected 4.6.0 4.6.5 semver | Not specified |
| CNA | Wireshark Foundation | Wireshark | affected 4.4.0 4.4.15 semver | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10 | unaffected 1:4.4.2-10.el10_2 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | unaffected 1:4.4.2-3.el10_0.4 * rpm | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 8 | Not specified | Not specified |
| ADP | Red Hat | Red Hat Enterprise Linux 9 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.wireshark.org/security/wnpa-sec-2026-17.html | [email protected] | www.wireshark.org | Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:26182 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | bugzilla.redhat.com | |
| access.redhat.com/security/cve/CVE-2026-5405 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| gitlab.com/wireshark/wireshark/-/issues/21105 | [email protected] | gitlab.com | Exploit, Issue Tracking, Third Party Advisory |
| security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5405.json | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | security.access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:20600 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | access.redhat.com | |
| gitlab.com/wireshark/wireshark/-/work_items/21105 | MITRE | gitlab.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Duc Anh Nguyen (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2026-05-01T00:01:04.898Z | Reported to Red Hat. |
| ADP | 2026-04-30T23:03:53.654Z | Made public. |
Solutions
CNA: Upgrade to version 4.6.5 or above
ADP: RHSA-2026:26182: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)
ADP: RHSA-2026:20600: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
Workarounds
ADP: If the RDP protocol dissector is not being used, it can be disabled via the "Enabled Protocols" dialog box in the Wireshark GUI application. This will also disable the protocol dissector when using "tshark", the command line tool. See the links below for instructions to disable a protocol in Wireshark, specifically the "Control Protocol Dissection" section and the "disabled_protos" configuration file option. https://www.wireshark.org/docs/wsug_html_chunked/ChCustProtocolDissectionSection.html https://www.wireshark.org/docs/wsug_html_chunked/ChAppFilesConfigurationSection.html