CVE-2026-5405
RDP Protocol Dissector Crash in Wireshark
Publication date: 2026-05-01
Last updated on: 2026-05-04
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wireshark | wireshark | From 4.4.0 (inc) to 4.4.15 (exc) |
| wireshark | wireshark | From 4.6.0 (inc) to 4.6.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-122 | A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). |
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5405 is a vulnerability in Wireshark versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 that affects the RDP protocol dissector. It is caused by a heap buffer overflow in the function handling uncompressed ZGFX segments, where attacker-controlled data is copied into a fixed-size buffer without proper bounds checking. This can cause the Wireshark application to crash and potentially allow an attacker to execute arbitrary code by tricking a user into opening a malicious packet trace file or injecting a malformed packet.
The root cause is the lack of validation of the length parameter before copying data, which leads to overwriting adjacent heap memory. The vulnerability can be triggered by specially crafted RDP session data containing an oversized uncompressed segment.
How can this vulnerability impact me? :
This vulnerability can impact you by causing denial of service through application crashes when processing malicious RDP packets or trace files. Additionally, it may allow an attacker to execute arbitrary code on your system if you open a crafted malicious packet trace, potentially compromising confidentiality, integrity, and availability of your system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by analyzing RDP traffic or packet trace files for malformed or malicious RDP packets that trigger the heap buffer overflow in the RDP dissector.
One practical method is to use Wireshark or tshark to open or analyze suspicious packet capture files (pcapng) that may contain malicious RDP sessions with oversized ZGFX uncompressed segments.
When running tshark with AddressSanitizer (ASAN) enabled, a crash with a SIGSEGV error and heap-buffer-overflow report indicates the presence of the vulnerability.
- Use tshark to analyze suspicious captures: tshark -r suspicious_capture.pcapng
- Monitor for crashes or errors related to the RDP dissector, especially SIGSEGV or heap-buffer-overflow messages.
- Use provided proof-of-concept (PoC) pcapng files or Python scripts (if available) to test your environment for vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The immediate and recommended mitigation step is to upgrade Wireshark to a fixed version that resolves this vulnerability.
- Upgrade Wireshark to version 4.6.5 or later, or 4.4.15 or later.
Avoid opening untrusted or suspicious packet trace files that may contain malformed RDP packets designed to trigger the vulnerability.
If upgrading immediately is not possible, consider disabling the RDP dissector in Wireshark as a temporary workaround to prevent processing of vulnerable packets.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The CVE-2026-5405 vulnerability in Wireshark allows for denial of service and possible code execution through a heap buffer overflow in the RDP dissector. This vulnerability impacts confidentiality, integrity, and availability of the affected system.
Since the vulnerability can lead to unauthorized code execution and system crashes, it may pose risks to the protection of sensitive data and system reliability, which are critical aspects of compliance with standards like GDPR and HIPAA.
Organizations using vulnerable versions of Wireshark might face challenges in maintaining compliance due to potential data breaches or system disruptions caused by exploitation of this vulnerability.
Mitigation by upgrading to fixed versions is necessary to reduce compliance risks.