Executive Summary

CVE-2026-5404 is a vulnerability in Wireshark's K12 RF5 file parser that involves a stack buffer overflow. Specifically, when exporting a crafted K12 .rf5 file, the function k12_dump_src_setting() copies two input strings into a fixed-size 8192-byte buffer without checking if their combined length exceeds the buffer size. If the input strings are excessively long (up to 65535 bytes each), this can cause a write of approximately 123 KB past the buffer boundary.

This unchecked copying can lead to crashes (such as SIGABRT or SIGSEGV) in protected builds of Wireshark or potentially allow code execution in unprotected builds. The vulnerability arises from improper use of memcpy operations in the k12.c file and is triggered by processing a maliciously crafted file.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause Wireshark to crash when it processes a maliciously crafted K12 RF5 file, resulting in a denial of service. An attacker could exploit this by injecting a malformed packet or tricking a user into opening a malicious packet trace file.

While the default protections in Wireshark such as stack canaries and ASLR make exploitation unlikely, in unprotected builds there is a potential risk of arbitrary code execution. Users of affected Wireshark versions (4.6.0 to 4.6.4 and 4.4.0 to 4.4.14) are advised to upgrade to later versions to mitigate this risk.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is triggered when Wireshark processes a maliciously crafted K12 RF5 file that causes a crash due to a stack buffer overflow in the file parser.

Detection involves monitoring for crashes or abnormal termination (such as SIGABRT or SIGSEGV signals) of Wireshark when opening or processing K12 .rf5 files or packet trace files.

There are no specific commands provided in the resources to detect this vulnerability on your network or system.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation step is to upgrade Wireshark to versions 4.6.5 or 4.4.15 or later, where the vulnerability has been fixed.

Avoid opening untrusted or suspicious K12 RF5 files or packet trace files that could contain malformed packets designed to trigger the vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of CVE-2026-5404 on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0