CVE-2026-3202
Crash in Wireshark NTS-KE Dissector Causes Denial of Service
Publication date: 2026-02-25
Last updated on: 2026-02-26
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wireshark | wireshark | From 4.6.0 (inc) to 4.6.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3202 is a vulnerability in Wireshark versions 4.6.0 to 4.6.3 affecting the NTS-KE (Network Time Security Key Exchange) protocol dissector.
The issue is caused by a null pointer dereference in the strcmp function within the dissect_nts_ke function, which attempts to read from a null address (0x0). This happens when Wireshark processes a specially crafted malformed packet capture file.
This improper handling of string data leads to a segmentation fault (crash) during packet dissection, which can be triggered by maliciously crafted packets.
How can this vulnerability impact me? :
This vulnerability can cause Wireshark to crash (denial of service) when processing maliciously crafted packet capture files.
Because the crash is due to a memory safety issue (null pointer dereference), it may also potentially be exploited for code execution, although the primary impact is denial of service.
Users running vulnerable versions of Wireshark, especially automated tools like tshark, are at risk of service interruption or exploitation when analyzing untrusted network traffic or capture files.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by attempting to process a crafted malformed packet capture file that triggers the crash in Wireshark's NTS-KE dissector."}, {'type': 'paragraph', 'content': "A suggested command to detect the vulnerability is to use tshark, Wireshark's command-line tool, to process a known malformed capture file that triggers the crash."}, {'type': 'list_item', 'content': 'tshark -r fuzz-2026-02-05-12996899075.pcap -V -n'}, {'type': 'paragraph', 'content': 'If the vulnerability is present, this command will cause a segmentation fault due to a null pointer dereference in the strcmp function within the dissect_nts_ke dissector.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
I don't know