CVE-2026-5404
K12 RF5 Parser Crash in Wireshark
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wireshark | wireshark | From 4.4.0 (inc) to 4.4.15 (exc) |
| wireshark | wireshark | From 4.6.0 (inc) to 4.6.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-120 | The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5404 is a vulnerability in Wireshark's K12 RF5 file parser that involves a stack buffer overflow. Specifically, when exporting a crafted K12 .rf5 file, the function k12_dump_src_setting() copies two input strings into a fixed-size 8192-byte buffer without checking if their combined length exceeds the buffer size. If the input strings are excessively long (up to 65535 bytes each), this can cause a write of approximately 123 KB past the buffer boundary.
This unchecked copying can lead to crashes (such as SIGABRT or SIGSEGV) in protected builds of Wireshark or potentially allow code execution in unprotected builds. The vulnerability arises from improper use of memcpy operations in the k12.c file and is triggered by processing a maliciously crafted file.
How can this vulnerability impact me? :
This vulnerability can cause Wireshark to crash when it processes a maliciously crafted K12 RF5 file, resulting in a denial of service. An attacker could exploit this by injecting a malformed packet or tricking a user into opening a malicious packet trace file.
While the default protections in Wireshark such as stack canaries and ASLR make exploitation unlikely, in unprotected builds there is a potential risk of arbitrary code execution. Users of affected Wireshark versions (4.6.0 to 4.6.4 and 4.4.0 to 4.4.14) are advised to upgrade to later versions to mitigate this risk.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is triggered when Wireshark processes a maliciously crafted K12 RF5 file that causes a crash due to a stack buffer overflow in the file parser.
Detection involves monitoring for crashes or abnormal termination (such as SIGABRT or SIGSEGV signals) of Wireshark when opening or processing K12 .rf5 files or packet trace files.
There are no specific commands provided in the resources to detect this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade Wireshark to versions 4.6.5 or 4.4.15 or later, where the vulnerability has been fixed.
Avoid opening untrusted or suspicious K12 RF5 files or packet trace files that could contain malformed packets designed to trigger the vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of CVE-2026-5404 on compliance with common standards and regulations such as GDPR or HIPAA.