CVE-2026-3202

Awaiting Analysis Awaiting Analysis - Queue

Crash in Wireshark NTS-KE Dissector Causes Denial of Service

Publication date: 2026-02-25

Last updated on: 2026-02-26

Assigner: GitLab Inc.

Description

NTS-KE protocol dissector crash in Wireshark 4.6.0 to 4.6.3 allows denial of service

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-02-25

Last Modified

2026-02-26

Generated

2026-07-06

AI Q&A

2026-02-25

EPSS Evaluated

2026-07-05

NVD

CVE-2026-3202

EUVD

EUVD-2026-8661

Affected Vendors & Products

Vendor	Product	Version / Range
wireshark	wireshark	From 4.6.0 (inc) to 4.6.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

CVE-2026-3202 is a vulnerability in Wireshark versions 4.6.0 to 4.6.3 affecting the NTS-KE (Network Time Security Key Exchange) protocol dissector.

The issue is caused by a null pointer dereference in the strcmp function within the dissect_nts_ke function, which attempts to read from a null address (0x0). This happens when Wireshark processes a specially crafted malformed packet capture file.

This improper handling of string data leads to a segmentation fault (crash) during packet dissection, which can be triggered by maliciously crafted packets.

Impact Analysis

This vulnerability can cause Wireshark to crash (denial of service) when processing maliciously crafted packet capture files.

Because the crash is due to a memory safety issue (null pointer dereference), it may also potentially be exploited for code execution, although the primary impact is denial of service.

Users running vulnerable versions of Wireshark, especially automated tools like tshark, are at risk of service interruption or exploitation when analyzing untrusted network traffic or capture files.

Compliance Impact

I don't know

Detection Guidance

[{'type': 'paragraph', 'content': "This vulnerability can be detected by attempting to process a crafted malformed packet capture file that triggers the crash in Wireshark's NTS-KE dissector."}, {'type': 'paragraph', 'content': "A suggested command to detect the vulnerability is to use tshark, Wireshark's command-line tool, to process a known malformed capture file that triggers the crash."}, {'type': 'list_item', 'content': 'tshark -r fuzz-2026-02-05-12996899075.pcap -V -n'}, {'type': 'paragraph', 'content': 'If the vulnerability is present, this command will cause a segmentation fault due to a null pointer dereference in the strcmp function within the dissect_nts_ke dissector.'}] [1]

Mitigation Strategies

I don't know

Hi! I’m here to help you understand CVE-2026-3202. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70