Wireshark SMB Object Export Integer Overflow Remote Code Execution Vulnerability

November 10th, 2026
ZDI-26-900 ZDI-CAN-31676

CVE ID

CVSS Score

8.8 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Vendors

Wireshark

Affected Products

Wireshark

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Wireshark. User interaction is required to exploit this vulnerability.

The specific flaw exists within the exporting of SMB objects from captured traffic. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before writing to memory. An attacker can leverage this vulnerability to execute code in the context of the current process.

Additional Details

version 4.6 fix: https://gitlab.com/wireshark/wireshark/-/commit/bf270c79258480c264296fe6f832cec2b3aecabb;
version 4.4 fix: https://gitlab.com/wireshark/wireshark/-/commit/bf4578f18e09536c8d8e939129e3c7ade3a5c8af


Disclosure Timeline

  • 2026-09-10 - Vulnerability reported to vendor
  • 2026-11-10 - Coordinated public release of advisory
  • 2026-11-10 - Advisory Updated

Credit

Mirae

Back to Advisories