Executive Summary

CVE-2026-3202 is a vulnerability in Wireshark versions 4.6.0 to 4.6.3 affecting the NTS-KE (Network Time Security Key Exchange) protocol dissector.

The issue is caused by a null pointer dereference in the strcmp function within the dissect_nts_ke function, which attempts to read from a null address (0x0). This happens when Wireshark processes a specially crafted malformed packet capture file.

This improper handling of string data leads to a segmentation fault (crash) during packet dissection, which can be triggered by maliciously crafted packets.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause Wireshark to crash (denial of service) when processing maliciously crafted packet capture files.

Because the crash is due to a memory safety issue (null pointer dereference), it may also potentially be exploited for code execution, although the primary impact is denial of service.

Users running vulnerable versions of Wireshark, especially automated tools like tshark, are at risk of service interruption or exploitation when analyzing untrusted network traffic or capture files.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': "This vulnerability can be detected by attempting to process a crafted malformed packet capture file that triggers the crash in Wireshark's NTS-KE dissector."}, {'type': 'paragraph', 'content': "A suggested command to detect the vulnerability is to use tshark, Wireshark's command-line tool, to process a known malformed capture file that triggers the crash."}, {'type': 'list_item', 'content': 'tshark -r fuzz-2026-02-05-12996899075.pcap -V -n'}, {'type': 'paragraph', 'content': 'If the vulnerability is present, this command will cause a segmentation fault due to a null pointer dereference in the strcmp function within the dissect_nts_ke dissector.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

I don't know

Useful 0 Not Useful 0