CVE-2026-3203

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-3203", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2026-02-25T14:35:46.001Z", "datePublished": "2026-02-25T14:36:00.984Z", "dateUpdated": "2026-09-17T18:35:21.214Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "Wireshark", "vendor": "Wireshark Foundation", "versions": [{"lessThan": "4.6.4", "status": "affected", "version": "4.6.0", "versionType": "semver"}, {"lessThan": "4.4.14", "status": "affected", "version": "4.4.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-126", "description": "CWE-126: Buffer Over-read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-03-27T13:56:59.788Z"}, "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2026-07.html"}, {"name": "GitLab Issue #21009", "tags": ["issue-tracking", "permissions-required"], "url": "https://gitlab.com/wireshark/wireshark/-/issues/21009"}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.6.4 or above"}], "title": "Buffer Over-read in Wireshark"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T20:35:47.008169Z", "id": "CVE-2026-3203", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T18:35:21.214Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-3203", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T20:35:47.008169Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:35:51.972Z"}}], "cna": {"title": "Buffer Over-read in Wireshark", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Wireshark Foundation", "product": "Wireshark", "versions": [{"status": "affected", "version": "4.6.0", "lessThan": "4.6.4", "versionType": "semver"}, {"status": "affected", "version": "4.4.0", "lessThan": "4.4.14", "versionType": "semver"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Upgrade to version 4.6.4 or above"}], "references": [{"url": "https://www.wireshark.org/security/wnpa-sec-2026-07.html"}, {"url": "https://gitlab.com/wireshark/wireshark/-/issues/21009", "name": "GitLab Issue #21009", "tags": ["issue-tracking", "permissions-required"]}], "descriptions": [{"lang": "en", "value": "RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-126", "description": "CWE-126: Buffer Over-read"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2026-03-27T13:56:59.788Z"}}}, "cveMetadata": {"cveId": "CVE-2026-3203", "state": "PUBLISHED", "dateUpdated": "2026-09-17T18:35:21.214Z", "dateReserved": "2026-02-25T14:35:46.001Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2026-02-25T14:36:00.984Z", "assignerShortName": "GitLab"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Wireshark", "vendor": "Wireshark Foundation", "versions": [{"lessThan": "4.6.4", "status": "affected", "version": "4.6.0", "versionType": "semver"}, {"lessThan": "4.4.14", "status": "affected", "version": "4.4.0", "versionType": "semver"}]}], "source": "cve@gitlab.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*", "matchCriteriaId": "CFACEDB6-42A3-4BC9-99F1-ABC9725C6954", "versionEndExcluding": "4.4.14", "versionStartIncluding": "4.4.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wireshark:wireshark:*:*:*:*:*:*:*:*", "matchCriteriaId": "D75CCBC1-40C7-48D9-A33A-6260390864A4", "versionEndExcluding": "4.6.4", "versionStartIncluding": "4.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service"}, {"lang": "es", "value": "Fallo del disector del protocolo de perfil RF4CE en Wireshark de 4.6.0 a 4.6.3 y de 4.4.0 a 4.4.13 permite la denegaci\u00f3n de servicio"}], "id": "CVE-2026-3203", "lastModified": "2026-06-17T10:43:12.267", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "cve@gitlab.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3203", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T20:35:47.008169Z", "version": "2.0.3"}}]}, "published": "2026-02-25T15:20:55.973", "references": [{"source": "cve@gitlab.com", "tags": ["Issue Tracking"], "url": "https://gitlab.com/wireshark/wireshark/-/issues/21009"}, {"source": "cve@gitlab.com", "tags": ["Vendor Advisory"], "url": "https://www.wireshark.org/security/wnpa-sec-2026-07.html"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-126"}], "source": "cve@gitlab.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "wireshark: Buffer Over-read in Wireshark", "id": "2442639", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2442639"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-126", "details": ["A flaw was found in the RF4CE Profile dissector in Wireshark. This issue occurs when malformed packets are decoded from a pcap file or the network, causing a buffer over-read, resulting in a denial of service."], "mitigation": {"lang": "en:us", "value": "If the RF4CE Profile protocol dissector is not being used, it can be disabled via the \"Enabled Protocols\" dialog box in the Wireshark GUI application. This will also disable the protocol dissector when using \"tshark\", the command line tool.\nSee the links below for instructions to disable a protocol in Wireshark, specifically the \"Control Protocol Dissection\" section and the \"disabled_protos\" configuration file option.\nhttps://www.wireshark.org/docs/wsug_html_chunked/ChCustProtocolDissectionSection.html\nhttps://www.wireshark.org/docs/wsug_html_chunked/ChAppFilesConfigurationSection.html"}, "name": "CVE-2026-3203", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "wireshark", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-25T14:36:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-3203\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-3203\nhttps://gitlab.com/wireshark/wireshark/-/issues/21009\nhttps://www.wireshark.org/security/wnpa-sec-2026-07.html"], "statement": "This issue will cause a crash in Wireshark with no other security impact. Also, this flaw can only be exploited when a malformed pcap file is processed. Due to these reasons, this vulnerability has been rated with a moderate severity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.6.0,4.6.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[4.4.0,4.4.14)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Wireshark", "source": "cna", "vendor": "Wireshark Foundation"}, "product": "wireshark", "vendor": "wireshark"}], "analysis": {"en": {"generated_at": "2026-04-16T06:07:16.805735+00:00", "value": {"mitigation_remediation": ["Upgrade Wireshark to version 4.6.4 or later to obtain the fix", "Restrict the processing of RF4CE streams to trusted sources or offline capture files when an upgrade cannot be applied immediately", "Monitor Wireshark for unexpected crashes and enforce the use of the latest stable release in production environments"], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Wireshark software published by Wireshark Foundation. All releases from version 4.6.0 to 4.6.3 and from 4.4.0 to 4.4.13 are vulnerable. Users of earlier or later releases are not impacted.", "description_and_impact": "Wireshark versions 4.6.0 through 4.6.3 and 4.4.0 through 4.4.13 contain a buffer over-read in the RF4CE Profile protocol dissector causing a crash and resulting in denial of service. The flaw arises when the dissector reads beyond the bounds of the supplied packet data, leading to an unhandled exception. The impact is limited to the instance of Wireshark that processes the malformed packet, disrupting troubleshooting or network analysis.", "risk_and_exploitability": "The CVSS score of 5.5 indicates a medium severity, while the EPSS score of less than 1% signals a very low probability of automated exploitation. The vulnerability is not included in the CISA KEV catalog. The likely attack vector is application\u2011side: an attacker can supply a crafted RF4CE packet to Wireshark during packet capture or file import. If the application is running with elevated privileges, a crash may result in a denial of service for that user or system. No network\u2011level remote code execution is possible; the exploit requires delivery of malicious data to the victim\u2019s Wireshark instance."}}}}, "created": "2026-02-26T13:16:05.161800+00:00", "updated": "2026-04-16T06:15:26.911363+00:00", "vendors": ["wireshark", "wireshark$PRODUCT$wireshark"]}