Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-08T20:50:50 wireshark: Wireshark: Denial of service via Z39.50 protocol dissector crash 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CWE-131

Z39.50 protocol dissector crash in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows denial of service

A flaw was found in Wireshark's Z39.50 protocol dissector. A heap buffer overflow can occur when the dissector processes malformed Z39.50 records with partial directory entries, as the pre-allocated array size is calculated using floor division and does not account for additional partial entries. An attacker could exploit this by convincing a user to open a specially crafted packet capture file, causing Wireshark to crash. This results in a denial of service.

Moderate: A heap buffer overflow in Wireshark's Z39.50 protocol dissector can lead to a denial of service. This flaw requires user interaction, specifically opening a specially crafted packet capture file, limiting its immediate impact on typical server deployments. Avoid opening capture files from untrusted sources. Red Hat Enterprise Linux 10 Fix deferred wireshark https://www.cve.org/CVERecord?id=CVE-2026-15170 https://nvd.nist.gov/vuln/detail/CVE-2026-15170 https://gitlab.com/wireshark/wireshark/-/work_items/21397 https://www.wireshark.org/security/wnpa-sec-2026-58.html