CVE-2026-6526

NULL Pointer Dereference in Wireshark

5.5 MediumFix available

RTSP protocol dissector crash in Wireshark 4.6.0 to 4.6.4

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.12%Up 0.1 points since Apr 30, 2026

What each source reports

CVE List Score used 5.5

NULL Pointer Dereference in Wireshark

RTSP protocol dissector crash in Wireshark 4.6.0 to 4.6.4

Record: CVE-2026-6526
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

EUVDEUVD-2026-26333 5.5

RTSP protocol dissector crash in Wireshark 4.6.0 to 4.6.4

Record: EUVD-2026-26333
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-fjhx-652f-phq2 5.5

RTSP protocol dissector crash in Wireshark 4.6.0 to 4.6.4

RTSP protocol dissector crash in Wireshark 4.6.0 to 4.6.4

Record: GHSA-fjhx-652f-phq2
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

NVD 5.5

RTSP protocol dissector crash in Wireshark 4.6.0 to 4.6.4

Record: CVE-2026-6526
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSV 5.5

NULL Pointer Dereference in Wireshark

RTSP protocol dissector crash in Wireshark 4.6.0 to 4.6.4

Record: CVE-2026-6526
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-6526 5.5

RTSP protocol dissector crash in Wireshark 4.6.0 to 4.6.4

Record: DEBIAN-CVE-2026-6526
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 6 moreShow less

OSVUBUNTU-CVE-2026-6526 5.5

RTSP protocol dissector crash in Wireshark 4.6.0 to 4.6.4

Record: UBUNTU-CVE-2026-6526
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVCLSA-2026-1785491682 No score

wireshark: Fix of 28 CVEs

CVE-2026-15172: do not precompute the FMP/NOTIFY handle list length to avoid an integer overflow
CVE-2026-15174: cap E-DCH DDI entries at MAX_EDCH_DDIS in the Catapult DCT2000 dissector
CVE-2026-5407: check for offset overflow in SMB2 EA info and notify data dissection
CVE-2026-6534: skip USB HID items with a report size of zero to prevent an infinite loop
CVE-2026-6533: sanity check the LZ77 uncompression size
CVE-2026-6522: check for offset overflow on unknown RPKI-RTR PDU types to prevent an infinite loop
CVE-2026-5404: fix a stack buffer overflow when writing K12 source descriptor records
CVE-2026-6529: report the proper iLBC decoded length for multi-frame payloads
CVE-2026-6530: require equal-size fragments for DCP ETSI Reed-Solomon reassembly
CVE-2026-6870: stop using a global tree pointer in the GSM RP dissector
CVE-2026-6869: bound WebSocket permessage-deflate decompression buffer growth
CVE-2026-6521: prevent infinite loops in OpenFlow v5 action and table description dissection
CVE-2026-6526: check the strstr() result when resolving HTTP Location targets to avoid a crash
CVE-2026-6532: fix a heap buffer overflow in the Kismet dissector
CVE-2026-15163: advance dissection offsets in the MIH, MPEG DSM-CC, eDonkey and MEGACO dissectors to prevent infinite loops

Record: CLSA-2026-1785491682
Updated: 2026-11-02

OSVCLSA-2026-1786479348 No score

wireshark: Fix of 26 CVEs

Add wireshark-0019-epan-add-simple-recursion-checks.patch: backport the increment/decrement_dissection_depth() API, a prerequisite for the recursion-depth fixes below (3.4.10 has no such API)
CVE-2023-1994: GQUIC dissector: fix a NULL pointer dereference
CVE-2024-4853: editcap: do not memmove more than the allocated buffer holds
CVE-2024-4855: editcap, libwiretap: do not use the array of initial decryption secrets after it has been freed
CVE-2026-15164: ciscodump: do not try to write more than PACKET_MAX_SIZE
CVE-2026-15167: DBS Etherwatch reader: keep buffer slack for an extra byte
CVE-2023-1993: LISP dissector: do not read past the LCAF payload length
CVE-2026-6867: SMB2 dissector: put bounds on total chained compression
CVE-2026-15172: FMP/NOTIFY dissector: stop precomputing the HandleList length
CVE-2026-15174: catapult-dct2000 dissector: cap the E-DCH no_ddi_entries count at MAX_EDCH_DDIS
CVE-2026-5407: SMB2 dissector: check for offset overflow in two more places
CVE-2026-6534: USB HID dissector: skip items with a report size of zero
CVE-2026-6522: RPKI-RTR dissector: check for overflow in the unknown PDU type case
CVE-2026-5404: K12 reader: fix a possible stack overflow when writing
CVE-2026-6529: iLBC codec plugin: report the proper decoded length in the multiframe case
CVE-2026-6530: DCP-ETSI dissector: reject a Reed-Solomon reassembly whose total size is not fcount * plen
CVE-2026-6870: GSM RP dissector: stop using a global for reassembly state
CVE-2026-6869: WebSocket dissector: put bounds on zlib decompression
CVE-2026-6521: OpenFlow v5 dissector: bound the OXM, action and match walks so a crafted message cannot drive an infinite loop
CVE-2026-6526: HTTP dissector: check the strstr() results before dereferencing them
CVE-2026-6532: kismet dissector: fix a heap buffer overflow
CVE-2026-5401: AFP Spotlight dissector: add recursion checks
CVE-2026-5406: fcswils dissector: add recursion checks
CVE-2026-5408: BT DHT dissector: add recursion checks
CVE-2026-6538: BEEP dissector: prevent overflow and add recursion checks
CVE-2026-6527: asn2wrs and the generated ASN.1 dissectors: treat open types as potentially cyclic and add recursion checks
CVE-2026-6535: epan: fix potential overflows in zlib decompression

Record: CLSA-2026-1786479348
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10686-1 No score

libwireshark19-4.6.5-1.1 on GA media

These are all security issues fixed in the libwireshark19-4.6.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10686-1
Updated: 2026-11-02

OSVSUSE-SU-2026:2203-1 No score

Security update for wireshark

This update for wireshark fixes the following issues

CVE-2026-5401: AFP dissector crash (bsc#1263756).
CVE-2026-5403: SBC audio codec crash (bsc#1263765).
CVE-2026-5404: K12 RF5 file parser crash (bsc#1263766).
CVE-2026-5405: RDP dissector crash (bsc#1263767).
CVE-2026-5406: FC-SWILS dissector crash (bsc#1263754).
CVE-2026-5407: SMB2 dissector infinite loop (bsc#1263753).
CVE-2026-5408: BT-DHT dissector crash (bsc#1263752).
CVE-2026-5653: DCP-ETSI dissector crash (bsc#1263750).
CVE-2026-5656: Profile import crash and possible code execution (bsc#1263809).
CVE-2026-5657: iLBC audio codec crash (bsc#1263747).
CVE-2026-6519: MBIM protocol dissector infinite loop (bsc#1263746).
CVE-2026-6520: OpenFlow v6 protocol dissector infinite loop (bsc#1263745).
CVE-2026-6521: OpenFlow v5 protocol dissector infinite loops (bsc#1263744).
CVE-2026-6522: RPKI-Router protocol dissector infinite loop (bsc#1263743).
CVE-2026-6523: GNW protocol dissector infinite loop (bsc#1263742).
CVE-2026-6526: RTSP protocol dissector crash (bsc#1263740).
CVE-2026-6527: ASN.1 PER dissector crash (bsc#1263739).
CVE-2026-6529: iLBC audio codec crash (bsc#1263737).
CVE-2026-6530: DCP-ETSI protocol dissector crash (bsc#1263736).
CVE-2026-6532: Kismet protocol dissector crash (bsc#1263734).
CVE-2026-6534: USB HID dissector infinite loop (bsc#1263732).
CVE-2026-6535: Dissection engine zlib decompression crash (bsc#1263731).
CVE-2026-6538: BEEP dissector crash (bsc#1263728).
CVE-2026-6867: SMB2 protocol dissector crash (bsc#1263727).
CVE-2026-6868: HTTP protocol dissector crash (bsc#1263762).
CVE-2026-6869: WebSocket protocol dissector crash (bsc#1263726).
CVE-2026-6870: GSM RP protocol dissector crash (bsc#1263725).
CVE-2026-7378: Sharkd utility crash (bsc#1263759).
CVE-2026-7379: Sharkd utility memory leak (bsc#1263758).

Record: SUSE-SU-2026:2203-1
Updated: 2026-11-02

OSVSUSE-SU-2026:3501-1 No score

Security update for wireshark

This update for wireshark fixes the following issues:

Update to version 4.6.7:

CVE-2026-5299: ICMPv6 dissector crash (bsc#1263757).
CVE-2026-5401: AFP dissector crash (bsc#1263756).
CVE-2026-5402: TLS dissector crash and possible code execution (bsc#1263755).
CVE-2026-5403: SBC audio codec crash (bsc#1263765).
CVE-2026-5404: K12 RF5 file parser crash (bsc#1263766).
CVE-2026-5405: RDP dissector crash (bsc#1263767).
CVE-2026-5406: FC-SWILS dissector crash (bsc#1263754).
CVE-2026-5407: SMB2 dissector infinite loop (bsc#1263753).
CVE-2026-5408: BT-DHT dissector crash (bsc#1263752).
CVE-2026-5409: Monero dissector crash (bsc#1263751).
CVE-2026-5653: DCP-ETSI dissector crash (bsc#1263750).
CVE-2026-5654: AMR-NB audio codec crash (bsc#1263749).
CVE-2026-5655: SDP dissector crash (bsc#1263748).
CVE-2026-5656: Profile import crash and possible code execution (bsc#1263809).
CVE-2026-5657: iLBC audio codec crash (bsc#1263747).
CVE-2026-6519: MBIM protocol dissector infinite loop (bsc#1263746).
CVE-2026-6520: OpenFlow v6 protocol dissector infinite loop (bsc#1263745).
CVE-2026-6521: OpenFlow v5 protocol dissector infinite loops (bsc#1263744).
CVE-2026-6522: RPKI-Router protocol dissector infinite loop (bsc#1263743).
CVE-2026-6523: GNW protocol dissector infinite loop (bsc#1263742).
CVE-2026-6524: MySQL protocol dissector crash (bsc#1263741).
CVE-2026-6525: IEEE 802.11 protocol dissector crash (bsc#1263810).
CVE-2026-6526: RTSP protocol dissector crash (bsc#1263740).
CVE-2026-6527: ASN.1 PER dissector crash (bsc#1263739).
CVE-2026-6528: TLS protocol dissector infinite loop (bsc#1263738).
CVE-2026-6529: iLBC audio codec crash (bsc#1263737).
CVE-2026-6530: DCP-ETSI protocol dissector crash (bsc#1263736).
CVE-2026-6531: SANE protocol dissector infinite loop (bsc#1263735).
CVE-2026-6532: Kismet protocol dissector crash (bsc#1263734).
CVE-2026-6533: Dissection engine LZ77 decompression crash (bsc#1263733).
CVE-2026-6534: USB HID dissector infinite loop (bsc#1263732).
CVE-2026-6535: Dissection engine zlib decompression crash (bsc#1263731).
CVE-2026-6536: DLMS/COSEM dissector infinite loop (bsc#1263730).
CVE-2026-6537: ZigBee dissector crash (bsc#1263729).
CVE-2026-6538: BEEP dissector crash (bsc#1263728).
CVE-2026-6867: SMB2 protocol dissector crash (bsc#1263727).
CVE-2026-6868: HTTP protocol dissector crash (bsc#1263762).
CVE-2026-6869: WebSocket protocol dissector crash (bsc#1263726).
CVE-2026-6870: GSM RP protocol dissector crash (bsc#1263725).
CVE-2026-7375: UDS protocol dissector infinite loop (bsc#1263761).
CVE-2026-7376: Sharkd utility crash (bsc#1263760).
CVE-2026-7378: Sharkd utility crash (bsc#1263759).
CVE-2026-7379: Sharkd utility memory leak (bsc#1263758).
CVE-2026-9759: ROHC protocol dissector crash (bsc#1266670).
CVE-2026-15163: Denial of Service via multiple protocol dissector infinite loops (bsc#1271133).
CVE-2026-15164: Denial of Service vulnerability in ciscodump (bsc#1271134).
CVE-2026-15165: Denial of Service via TLS ECH decryptor crash (bsc#1271135).
CVE-2026-15166: Denial of Service via IEEE 802.11 protocol dissector crash (bsc#1271136).
CVE-2026-15167: Denial of Service via DBS Etherwatch file parser crash (bsc#1271137).
CVE-2026-15168: BLF file parser allows possible information disclosure (bsc#1271138).
CVE-2026-15169: Denial of Service via UMTS FP protocol dissector crash (bsc#1271139).
CVE-2026-15170: Denial of service via Z39.50 protocol dissector crash (bsc#1271140).
CVE-2026-15171: Denial of service via SSH protocol dissector crash (bsc#1271141).
CVE-2026-15172: Denial of service via FMP/NOTIFY protocol dissector crash (bsc#1271142).
CVE-2026-15173: Denial of Service via pcapng file parser crash (bsc#1271143).
CVE-2026-15174: Denial of Service via Catapult DCT2000 protocol dissector crash (bsc#1271144).

Record: SUSE-SU-2026:3501-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`wireshark` TuxCare:AlmaLinux:9.6 From an advisory covering 15 CVEs	before 1:3.4.10-7.el9_6.tuxcare.els7	1:3.4.10-7.el9_6.tuxcare.els7
`wireshark-cli` TuxCare:AlmaLinux:9.6 From an advisory covering 15 CVEs	before 1:3.4.10-7.el9_6.tuxcare.els7	1:3.4.10-7.el9_6.tuxcare.els7
`wireshark-devel` TuxCare:AlmaLinux:9.6 From an advisory covering 15 CVEs	before 1:3.4.10-7.el9_6.tuxcare.els7	1:3.4.10-7.el9_6.tuxcare.els7
`wireshark` TuxCare:AlmaLinux:9.2 From an advisory covering 26 CVEs	before 1:3.4.10-4.el9_2.tuxcare.els13	1:3.4.10-4.el9_2.tuxcare.els13
`wireshark-cli` TuxCare:AlmaLinux:9.2 From an advisory covering 26 CVEs	before 1:3.4.10-4.el9_2.tuxcare.els13	1:3.4.10-4.el9_2.tuxcare.els13
`wireshark-devel` TuxCare:AlmaLinux:9.2 From an advisory covering 26 CVEs	before 1:3.4.10-4.el9_2.tuxcare.els13	1:3.4.10-4.el9_2.tuxcare.els13
`wireshark` Debian:14	before 4.6.5-1, plus listed versions 4.4.7-14.4.8-0exp14.4.9-14.6.0-0exp14.6.0-1 Show 8 moreShow less 4.6.0~rc1-0exp14.6.0~rc1-0exp24.6.1-14.6.1-24.6.2-14.6.2-34.6.3-14.6.4-1	4.6.5-1
`wireshark` SUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 56 CVEs	before 4.6.7-150700.21.11.1	4.6.7-150700.21.11.1
`wireshark` SUSE:Linux Enterprise Module for Desktop Applications 15 SP7 From an advisory covering 56 CVEs	before 4.6.7-150700.21.11.1	4.6.7-150700.21.11.1
`wireshark` Ubuntu:Pro:14.04:LTS	All versions, plus listed versions 1.10.2-11.10.3-11.10.5-1ubuntu11.10.5-21.10.6-1 Show 9 moreShow less 1.12.1+g01b65bf-4+deb8u11ubuntu0.14.04.12.6.3-1~ubuntu14.04.12.6.4-2~ubuntu14.04.12.6.5-1~ubuntu14.04.12.6.6-1~ubuntu14.04.02.6.8-1~ubuntu14.04.0~esm12.6.10-1~ubuntu14.04.0~esm12.6.10-1~ubuntu14.04.0~esm22.6.10-1~ubuntu14.04.0~esm3	None known

Show 9 moreShow less

Affected packages
Package	Affected	Fixed
`wireshark` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.12.7+g7fc8978-11.12.8+g5b6e543-22.0.1+g59ea380-3build12.0.2+ga16e22e-12.2.6+g32dac6a-2ubuntu0.16.04 Show 8 moreShow less 2.6.3-1~ubuntu16.04.12.6.4-2~ubuntu16.04.02.6.5-1~ubuntu16.04.02.6.6-1~ubuntu16.04.02.6.8-1~ubuntu16.04.02.6.10-1~ubuntu16.04.02.6.10-1~ubuntu16.04.0+esm12.6.10-1~ubuntu16.04.0+esm2	None known
`wireshark` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 2.4.2-12.4.3-12.4.4-12.4.5-12.6.3-1~ubuntu18.04.1 Show 7 moreShow less 2.6.4-2~ubuntu18.04.02.6.5-1~ubuntu18.04.02.6.6-1~ubuntu18.04.02.6.8-1~ubuntu18.04.02.6.10-1~ubuntu18.04.02.6.10-1~ubuntu18.04.0+esm12.6.10-1~ubuntu18.04.0+esm2	None known
`wireshark` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 3.0.5-13.0.7-13.2.1-13.2.2-13.2.3-13.2.3-1ubuntu0.1~esm13.2.3-1ubuntu0.1~esm2	None known
`wireshark` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 3.4.7-1~exp13.4.9-13.6.2-1ubuntu13.6.2-23.6.2-2ubuntu0.1~esm1	None known
`wireshark` Ubuntu:24.04:LTS	All versions, plus listed versions 4.0.8-14.0.10-14.0.11-14.2.0-14.2.2-14.2.2-1.1build14.2.2-1.1build24.2.2-1.1build3	None known
`wireshark` Ubuntu:25.10	All versions, plus listed versions 4.4.5-14.4.6-24.4.6-2build14.4.7-1	None known
`wireshark` Ubuntu:26.10	All versions, plus listed versions 4.6.4-14.6.6-14.6.6-24.6.6-2build1	None known
`wireshark` Ubuntu:26.04:LTS	All versions, plus listed versions 4.4.7-14.6.0-14.6.1-24.6.2-34.6.3-14.6.4-1	None known
`wireshark` openSUSE:Tumbleweed From an advisory covering 43 CVEs	before 4.6.5-1.1	4.6.5-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-6526 is a medium vulnerability (CVSS 5.5) in Wireshark, published April 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 2nd percentile. Fixed in wireshark 4.6.5-1.

References

Show 151 moreShow less