CVE-2026-15172: Integer Overflow in Wireshark's FMP Notify Dissector Leading to Denial of Service
The Yokai research team at Hakai Offensive Security identified a Denial of Service (DoS) vulnerability in Wireshark and TShark, tracked as CVE-2026-15172. The flaw stems from an integer overflow in the FMP Notify protocol dissector, specifically in the dissect_handleList() function, which improperly handles arithmetic on packet-controlled values without bounds checking. This leads to an infinite loop and excessive CPU usage, rendering the application unresponsive. Exploitation requires sending a specially crafted UDP packet with manipulated values to trigger the overflow during live capture or PCAP file processing. Network monitoring tools relying on the Wireshark engine are at risk of operational disruption, posing a significant threat to SOC and network visibility. Users are advised to update to patched versions as per the official Wireshark advisory.
Entenda a falha
A vulnerabilidade
CVE-2026-15172 is an integer overflow in the FMP Notify dissector of Wireshark and TShark, in dissect_handleList() in packet-fmp_notify.c. An attacker needs no authentication: they only have to get one crafted UDP packet in front of the dissector, either live on the network or inside a PCAP file someone opens. The result is an infinite loop with excessive CPU use that makes the application unresponsive, a denial of service. Sensors built on the Wireshark engine can stop inspecting traffic. The articles do not list affected or fixed version numbers; they only point to the official Wireshark advisory for patched releases.
Como funciona
A UDP packet for the FMP/NOTIFY protocol invoking the revokeHandleList procedure reaches the dissector. dissect_handleList() reads a handle count from the packet and loops that many times. On each pass it reads a block size from the packet and adds it to a running offset to decide where to read next. If the packet-supplied values make that offset fail to advance, the loop keeps re-reading the same data. Because the count can also be set very large, the loop runs billions of times, and the main packet-processing thread burns CPU until the tool stops responding.
Por que é vulnerável
The loop count and the block sizes both come straight from the packet and are used in arithmetic with no bounds checking. The running offset, listLength, is a signed 32-bit integer, so a crafted value can wrap it so that the advance is zero or negative and the read position never moves. Nothing validates that each step moves forward or that the declared count fits the packet. The articles do not describe the fix itself beyond saying patched versions exist.
Onde está
The flaw is in the dissect_handleList() function in packet-fmp_notify.c, which handles the revokeHandleList procedure of the FMP Notify dissector.
Como foi descoberta
The Yokai research team at Hakai Offensive Security identified the flaw and published a write-up on 2026-11-12. The articles do not say how it was found, when it was reported to Wireshark, or whether there was exploitation in the wild. They point to the official Wireshark security advisory for patched versions.
PoC pública
The Yokai write-up includes a public proof-of-concept script that builds a crafted FMP/NOTIFY UDP packet for the revokeHandleList procedure and sends it repeatedly to a target IP and port. It demonstrates the CPU-exhausting infinite loop, a denial of service, whether the packet is captured live or read from a PCAP. It is a working demonstration of availability impact only, not code execution. Since the script is public and a single packet is enough, patch Wireshark/TShark and any engine-based sensors promptly.
Publicada em: yokai.hakaisecurity.io/en-cve-2026-15172-integer-overflow-in-wiresharks-fmp-dissector/ ↗
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 18:16.
Linha do tempo
-
CVE-2026-15172: Integer Overflow in Wireshark's FMP Notify Dissector Leading to Denial of Service
ler a análise desta fonte ocultar
The Yokai research team at Hakai Offensive Security identified a Denial of Service (DoS) vulnerability in Wireshark and TShark, tracked as CVE-2026-15172. The flaw stems from an integer overflow in the FMP Notify protocol dissector, specifically in the dissect_handleList() function, which improperly handles arithmetic on packet-controlled values without bounds checking. This leads to an infinite loop and excessive CPU usage, rendering the application unresponsive. Exploitation requires sending a specially crafted UDP packet with manipulated values to trigger the overflow during live capture or PCAP file processing. Network monitoring tools relying on the Wireshark engine are at risk of operational disruption, posing a significant threat to SOC and network visibility. Users are advised to update to patched versions as per the official Wireshark advisory.