CVE-2026-5299 Wireshark Foundation CVE debrief

Who should care

Network administrators, security teams, and users of Wireshark should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

CVE-2026-5299 is a medium-severity vulnerability in Wireshark's ICMPv6 PvD protocol dissector that could lead to a denial-of-service attack. Network administrators and security teams should assess their exposure, apply patches or mitigations, and monitor network traffic for potential exploitation attempts.

• Potential disruption of network monitoring and analysis capabilities.
• Possible impact on incident response and threat hunting activities.
• Need for verification of Wireshark versions and configurations.
• Requirement for patching or updating Wireshark to prevent exploitation.

Technical summary

The ICMPv6 PvD protocol dissector in Wireshark is vulnerable to a crash, potentially leading to a denial-of-service (DoS) attack. Affected versions include 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14. The vulnerability is caused by a flaw in the protocol dissector that can be exploited by a specially crafted packet, leading to a crash and potential disruption of network monitoring and analysis capabilities.

Defensive priority

Medium priority for network administrators and security teams to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure by reviewing network configurations and Wireshark versions in use.
• Apply patches or updates to Wireshark to address the vulnerability.
• Monitor network traffic for potential exploitation attempts.
• Consider implementing compensating controls, such as network segmentation or intrusion detection systems.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including affected versions and potential impact. However, there is limited information on exploitation or victim data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.