{"id":"CVE-2026-5405","state":"PUBLISHED","title":"Heap-based Buffer Overflow in Wireshark","description":"RDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution","publishedAt":"2026-04-30T23:03:53.654Z","updatedAt":"2026-07-15T00:43:51.365Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","source":"GitLab"},"assigner":"GitLab","products":["Wireshark Foundation Wireshark"],"affected":[{"vendor":"Wireshark Foundation","product":"Wireshark","defaultStatus":"unaffected","versions":[{"version":"4.6.0","status":"affected","lessThan":"4.6.5","versionType":"semver"},{"version":"4.4.0","status":"affected","lessThan":"4.4.15","versionType":"semver"}]}],"references":["https://www.wireshark.org/security/wnpa-sec-2026-17.html","https://gitlab.com/wireshark/wireshark/-/issues/21105","https://access.redhat.com/security/cve/CVE-2026-5405","https://bugzilla.redhat.com/show_bug.cgi?id=2464273","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5405.json","https://access.redhat.com/errata/RHSA-2026:26182","https://access.redhat.com/errata/RHSA-2026:20600"],"weaknesses":["CWE-122"],"ingestedAt":"2026-10-29T20:12:32.778Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/5xxx/CVE-2026-5405.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-5405","state":"PUBLISHED","datePublished":"2026-04-30T23:03:53.654Z","dateUpdated":"2026-07-15T00:43:51.365Z","assignerShortName":"GitLab","assignerOrgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateReserved":"2026-04-02T06:33:26.681Z"},"containers":{"cna":{"title":"Heap-based Buffer Overflow in Wireshark","descriptions":[{"lang":"en","value":"RDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution"}],"affected":[{"vendor":"Wireshark Foundation","product":"Wireshark","defaultStatus":"unaffected","versions":[{"version":"4.6.0","status":"affected","lessThan":"4.6.5","versionType":"semver"},{"version":"4.4.0","status":"affected","lessThan":"4.4.15","versionType":"semver"}]}],"references":[{"url":"https://www.wireshark.org/security/wnpa-sec-2026-17.html"},{"url":"https://gitlab.com/wireshark/wireshark/-/issues/21105","name":"GitLab Issue #21105","tags":["issue-tracking","permissions-required"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-122","lang":"en","description":"CWE-122: Heap-based Buffer Overflow","type":"CWE"}]}],"providerMetadata":{"shortName":"GitLab","orgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateUpdated":"2026-04-30T23:03:53.654Z"},"solutions":[{"lang":"en","value":"Upgrade to version 4.6.5 or above"}],"credits":[{"lang":"en","value":"Duc Anh Nguyen","type":"finder"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-02T03:55:30.982524Z","id":"CVE-2026-5405","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-04T19:41:26.095Z"}},{"title":"wireshark: Heap-based Buffer Overflow in Wireshark","descriptions":[{"lang":"en","value":"A flaw was found in the RDP protocol dissector in Wireshark. This issue occurs when malformed packets are decoded from a pcap file or the network, causing a heap-based buffer overflow, resulting in a denial of service or potentially in code execution."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"wireshark","defaultStatus":"affected","versions":[{"version":"1:4.4.2-10.el10_2","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","packageName":"wireshark","defaultStatus":"affected","versions":[{"version":"1:4.4.2-3.el10_0.4","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux_eus:10.0"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"wireshark","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"wireshark","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"wireshark","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"wireshark","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:9"]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-5405","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2464273","name":"RHBZ#2464273","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5405.json","tags":["x_sadp-csaf-vex"]},{"url":"https://access.redhat.com/errata/RHSA-2026:26182","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:20600","tags":["vendor-advisory","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"namespace":"https://access.redhat.com/security/updates/classification/","value":"Important"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-122","description":"Heap-based Buffer Overflow","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat-SADP","orgId":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","dateUpdated":"2026-07-15T00:43:51.365Z"},"datePublic":"2026-04-30T23:03:53.654Z","solutions":[{"lang":"en","value":"RHSA-2026:26182: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"},{"lang":"en","value":"RHSA-2026:20600: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}],"timeline":[{"lang":"en","time":"2026-05-01T00:01:04.898Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-04-30T23:03:53.654Z","value":"Made public."}],"workarounds":[{"lang":"en","value":"If the RDP protocol dissector is not being used, it can be disabled via the \"Enabled Protocols\" dialog box in the Wireshark GUI application. This will also disable the protocol dissector when using \"tshark\", the command line tool.\n\nSee the links below for instructions to disable a protocol in Wireshark, specifically the \"Control Protocol Dissection\" section and the \"disabled_protos\" configuration file option.\n\nhttps://www.wireshark.org/docs/wsug_html_chunked/ChCustProtocolDissectionSection.html\nhttps://www.wireshark.org/docs/wsug_html_chunked/ChAppFilesConfigurationSection.html"}],"x_adpType":"supplier","x_generator":{"engine":"sadp-cli 1.0.0"}}]}}}