CVE-2026-15167
Analyzed Analyzed - Analysis Complete

DBS Etherwatch Parser Crash in Wireshark

Publication date: 2026-07-08

Last updated on: 2026-07-09

Assigner: GitLab Inc.

Description
DBS Etherwatch file parser crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-08
Last Modified
2026-07-09
Generated
2026-07-11
AI Q&A
2026-07-09
EPSS Evaluated
2026-07-09
NVD
CVE-2026-15167

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wireshark wireshark From 4.4.0 (inc) to 4.4.17 (exc)
wireshark wireshark From 4.6.0 (inc) to 4.6.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a crash in the DBS Etherwatch file parser component of Wireshark versions 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16. It allows an attacker to cause a denial of service by triggering the crash.

Impact Analysis

The impact of this vulnerability is a denial of service (DoS), meaning that an attacker can cause Wireshark to crash, potentially disrupting network analysis or monitoring activities.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

This vulnerability is triggered by opening or auto-processing specially crafted DBS Etherwatch capture files in vulnerable Wireshark versions. Detection involves identifying attempts to open such malformed packet trace files or monitoring for crashes in Wireshark versions 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16.

Since the vulnerability causes a crash due to heap buffer overflow when parsing malicious files, monitoring Wireshark logs or crash reports for unexpected terminations when processing DBS Etherwatch files can help detect exploitation attempts.

There are no specific commands provided in the resources to detect this vulnerability on a network or system.

Mitigation Strategies

The immediate mitigation step is to upgrade Wireshark to versions 4.6.7 or 4.4.17 (or later), which contain fixes for this vulnerability.

Avoid opening or auto-processing untrusted or suspicious DBS Etherwatch capture files in vulnerable Wireshark versions to prevent triggering the crash.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15167. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart