CVE-2026-6524

Received Received - Intake

MySQL Protocol Dissector Crash in Wireshark

Publication date: 2026-04-30

Last updated on: 2026-05-01

Assigner: GitLab Inc.

Description

MySQL protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-30

Last Modified

2026-05-01

Generated

2026-07-06

AI Q&A

2026-04-30

EPSS Evaluated

2026-07-05

NVD

CVE-2026-6524

EUVD

EUVD-2026-26332

Affected Vendors & Products

Vendor	Product	Version / Range
wireshark	wireshark	From 4.4.0 (inc) to 4.4.14 (inc)
wireshark	wireshark	From 4.6.0 (inc) to 4.6.4 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-824	The product accesses or uses a pointer that has not been initialized.

Attack-Flow Graph

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-6524 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Executive Summary

CVE-2026-6524 is a vulnerability in Wireshark's MySQL protocol dissector that can cause the application to crash. This happens due to a pointer dereference issue where a pointer field in the param_metas structure is not properly initialized but later used, leading to a segmentation fault.

The crash can be triggered by opening a specially crafted malicious packet trace file or by injecting a malformed packet, which causes Wireshark or tshark to fail with a memory access violation.

This vulnerability affects Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14.

Impact Analysis

This vulnerability can cause Wireshark or tshark to crash unexpectedly when processing malicious or malformed MySQL protocol packets.

The impact is a denial of service (DoS), where the affected software becomes unavailable or unusable due to the crash.

While no known exploits currently exist, an attacker could potentially disrupt network analysis or monitoring by triggering this crash.

Detection Guidance

This vulnerability can be detected by observing crashes in Wireshark or tshark when processing specific PCAP files that contain malformed MySQL protocol packets.

Opening a malicious packet trace file with Wireshark or tshark may trigger a crash due to a segmentation fault caused by the vulnerability.

While no explicit detection commands are provided, monitoring for crashes or AddressSanitizer errors related to Wireshark or tshark when analyzing MySQL traffic can indicate the presence of this issue.

Mitigation Strategies

To mitigate this vulnerability, users should upgrade Wireshark to versions 4.6.5 or 4.4.15 or later, where the issue has been fixed.

Avoid opening untrusted or potentially malicious PCAP files containing MySQL protocol data in vulnerable versions of Wireshark or tshark.

Hi! I’m here to help you understand CVE-2026-6524. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70