CVE-2026-5654 Wireshark Foundation CVE debrief

Who should care

Network administrators and security teams responsible for managing Wireshark installations should assess exposure and apply patches or updates as needed. They should also monitor network traffic for potential exploitation attempts and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review and track例外, re

Why it matters

CVE-2026-5654 is a medium-severity vulnerability in Wireshark that can lead to denial-of-service attacks. Network administrators and security teams should assess exposure, prioritize patching, and monitor network traffic.

• Denial-of-service attacks may be launched against vulnerable Wireshark installations
• Network administrators must assess exposure and prioritize patching
• Security teams should monitor network traffic for potential exploitation attempts

Technical summary

The AMR-NB codec in Wireshark versions 4.4.0 to 4.4.14 and 4.6.0 to 4.6.4 crashes when processing certain input, leading to a denial-of-service vulnerability. The vulnerability is caused by a flaw in the AMR-NB codec, which is used by Wireshark to decode audio data. When a specially crafted packet is processed, it can cause the Wireshark application to crash, resulting in a denial-of-service condition. The vulnerability is considered medium-severity and is being proactively monitored by security teams. Network administrators and security teams should assess exposure and apply patches or updates as needed to prevent exploitation.

Defensive priority

Medium priority for network administrators and security teams to assess exposure and apply patches

Recommended defensive actions

• Assess exposure by reviewing network configurations and Wireshark versions
• Apply patches or updates to vulnerable Wireshark installations
• Monitor network traffic for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is described in the CVE record and NVD vulnerability detail page. Wireshark has provided a vendor advisory. The CVE record was published on 2026-04-30T07:16:38.650Z and has not been modified since then. The NVD vulnerability detail page provides additional information about the vulnerability, including its CVSS score and severity. Network administrators and security teams should review the CVE record and NVD vulnerability detail page to understand the vulnerability and its potential impact on their systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.