CVE-2026-15169

Analyzed Analyzed - Analysis Complete

UMTS FP Protocol Dissector DoS in Wireshark

Publication date: 2026-07-08

Last updated on: 2026-07-09

Assigner: GitLab Inc.

Description

UMTS FP protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-09

Generated

2026-07-12

AI Q&A

2026-07-09

EPSS Evaluated

2026-07-10

NVD

CVE-2026-15169

Affected Vendors & Products

Vendor	Product	Version / Range
wireshark	wireshark	From 4.4.0 (inc) to 4.4.17 (exc)
wireshark	wireshark	From 4.6.0 (inc) to 4.6.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability is a crash in the UMTS FP protocol dissector component of Wireshark versions 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16. It allows an attacker to cause a denial of service by triggering the crash.

Impact Analysis

The impact of this vulnerability is a denial of service condition. An attacker could exploit this flaw to crash Wireshark, potentially disrupting network traffic analysis or monitoring activities.

Compliance Impact

The provided information does not specify any direct impact of the CVE-2026-15169 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Detection Guidance

This vulnerability is triggered by opening a specially crafted capture file or by receiving a malformed packet that causes the UMTS FP protocol dissector in Wireshark to crash.

Detection involves monitoring for crashes or abnormal behavior in Wireshark or TShark when analyzing UMTS FP protocol traffic or capture files.

Since the vulnerability is related to malformed packets or capture files, you can attempt to detect suspicious UMTS FP traffic or malformed packet traces by using Wireshark or TShark with filters targeting UMTS FP protocol fields.

Use Wireshark or TShark to open capture files and observe if the application crashes or behaves unexpectedly.
Apply display filters in Wireshark such as `umts-fp` to isolate UMTS FP protocol traffic.
Monitor logs or crash reports from Wireshark or TShark for signs of crashes related to UMTS FP dissector.

Mitigation Strategies

The primary mitigation step is to upgrade Wireshark to a version where the vulnerability is fixed.

Upgrade Wireshark to version 4.6.7 or later, or 4.4.17 or later.

Avoid opening untrusted or suspicious capture files that may contain specially crafted UMTS FP packets.

Be cautious when analyzing UMTS FP protocol traffic from untrusted sources to prevent triggering the vulnerability.

Hi! I’m here to help you understand CVE-2026-15169. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70