ZigBee Protocol Dissector Crash in Wireshark

Executive Summary

CVE-2026-6537 is a stack buffer overflow vulnerability in Wireshark's ZigBee Direct dissector. It occurs because the function handling decryption allocates a fixed-size buffer but does not validate the length of the input data before decrypting it. This allows an attacker to supply specially crafted data that exceeds the buffer size, causing a stack overflow.

The vulnerability can be triggered by opening a maliciously crafted pcap file, which leads to a crash or arbitrary memory corruption. The attacker can control the overflow data due to knowledge of the encryption keystream.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause Wireshark to crash (denial of service) when processing malicious ZigBee protocol data. In some cases, it may lead to arbitrary memory corruption, which could potentially be exploited for further attacks.

Users who open specially crafted packet capture files may experience application crashes, disrupting network analysis activities.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to process potentially malicious ZigBee packet capture files using Wireshark or tshark. Specifically, running tshark on a crafted pcap file that triggers the vulnerability can reproduce the crash.

• Use the command `tshark -r <malicious_pcap_file>` to test if the vulnerability can be triggered, as the crash occurs when processing malformed ZigBee packets.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Wireshark to a fixed version that addresses this vulnerability.

• Upgrade to Wireshark version 4.6.5, 4.4.15, or later.

Avoid opening untrusted or malformed ZigBee packet capture files until the upgrade is applied.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0