WI
Product
Wireshark
795
CVEs
0
On KEV
9.8
Max CVSS
19
New 30D
Severity mix
Critical 3High 237Medium 233Low 1
Watch
Add Wireshark to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-76886 | 9.8 | Aug 19 | Heap-based Buffer Overflow in Wireshark Affected: 4.4.0 before 4.4.18; 4.6.0 before 4.6.8 |
| CVE-2022-0582 | 9.8 | Feb 14 | Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file Affected: 3.4.0 before 3.4.12; 3.6.0; 3.6.1 |
| CVE-2018-6836 | 9.8 | Feb 8 | The netmonrec_comment_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an uninitialized memory address, which allows remote attackers… Affected: through 2.4.4 |
| CVE-2026-95387 | 8.8 | Sep 29 | Heap-based Buffer Overflow in Wireshark Affected: 4.4.0 before 4.4.19; 4.6.0 before 4.6.9 |
| CVE-2026-5402 | 8.8 | Apr 30 | Heap-based Buffer Overflow in Wireshark Affected: 4.6.0 through 4.6.4 |
| CVE-2021-22191 | 8.8 | Mar 15 | Improper URL handling in Wireshark 3.4.0 to 3.4.3 and 3.2.0 to 3.2.11 could allow remote code execution via via packet injection or crafted capture file Affected: 3.2.0 through 3.2.11; 3.4.0 through 3.4.3 |
| CVE-2026-95389 | 8.1 | Sep 29 | Heap-based Buffer Overflow in Wireshark Affected: 4.4.0 before 4.4.19; 4.6.0 before 4.6.9 |
| CVE-2026-96419 | 7.8 | Sep 29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark Affected: 4.4.0 before 4.4.19; 4.6.0 before 4.6.9 |
| CVE-2026-5403 | 7.8 | Apr 30 | Heap-based Buffer Overflow in Wireshark Affected: 4.4.0 before 4.4.15; 4.6.0 before 4.6.5 |
| CVE-2026-5656 | 7.8 | Apr 30 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark Affected: 4.4.0 before 4.4.15; 4.6.0 before 4.6.5 |
| CVE-2026-5405 | 7.8 | Apr 30 | Heap-based Buffer Overflow in Wireshark Affected: 4.4.0 before 4.4.15; 4.6.0 before 4.6.5 |
| CVE-2023-6175 | 7.8 | Mar 26 | NetScreen file parser crash in Wireshark 4.0.0 to 4.0.10 and 3.6.0 to 3.6.18 allows denial of service via crafted capture file Affected: 3.6.0 through 3.6.18; 4.0.0 through 4.0.10 |
| CVE-2016-2521 | 7.8 | Feb 28 | Untrusted search path vulnerability in the WiresharkApplication class in ui/qt/wireshark_application.cpp in Wireshark 1.12.x before 1.12.10 and 2.0.x before 2.0.2 on Windows… Affected: 1.12.0; 1.12.1; 1.12.2; 1.12.3; 1.12.4; 1.12.5; +6 more |
| CVE-2026-76928 | 7.5 | Aug 19 | NULL Pointer Dereference in Wireshark Affected: 4.4.0 before 4.4.18; 4.6.0 before 4.6.8 |
| CVE-2026-76927 | 7.5 | Aug 19 | NULL Pointer Dereference in Wireshark Affected: 4.4.0 before 4.4.18; 4.6.0 before 4.6.8 |
| CVE-2026-76919 | 7.5 | Aug 19 | Use of Uninitialized Variable in Wireshark Affected: 4.4.0 before 4.4.18; 4.6.0 before 4.6.8 |
| CVE-2026-76880 | 7.5 | Aug 19 | Out-of-bounds Write in Wireshark Affected: 4.4.0 before 4.4.18; 4.6.0 before 4.6.8 |
| CVE-2026-76879 | 7.5 | Aug 19 | Stack-based Buffer Overflow in Wireshark Affected: 4.4.0 before 4.4.18; 4.6.0 before 4.6.8 |
| CVE-2026-76888 | 7.5 | Aug 19 | Heap-based Buffer Overflow in Wireshark Affected: 4.4.0 before 4.4.18; 4.6.0 before 4.6.8 |
| CVE-2026-15169 | 7.5 | Jul 8 | Heap-based Buffer Overflow in Wireshark Affected: 4.4.0 before 4.4.17; 4.6.0 before 4.6.7 |
| CVE-2026-15163 | 7.5 | Jul 8 | Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark Affected: 4.4.0 before 4.4.17; 4.6.0 before 4.6.7 |
| CVE-2026-5654 | 7.5 | Apr 30 | Stack-based Buffer Overflow in Wireshark Affected: 4.4.0 through 4.4.14; 4.6.0 through 4.6.4 |
| CVE-2026-5655 | 7.5 | Apr 30 | Use After Free in Wireshark Affected: 4.6.0 through 4.6.4 |
| CVE-2026-5657 | 7.5 | Apr 30 | Double Free in Wireshark Affected: 4.4.0 through 4.4.14; 4.6.0 through 4.6.4 |
| CVE-2026-5653 | 7.5 | Apr 30 | Heap-based Buffer Overflow in Wireshark Affected: 4.4.0 through 4.4.14; 4.6.0 through 4.6.4 |
| CVE-2026-6520 | 7.5 | Apr 30 | Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark Affected: 4.4.0 through 4.4.14; 4.6.0 through 4.6.4 |
| CVE-2026-6519 | 7.5 | Apr 30 | Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark Affected: 4.4.0 through 4.4.14; 4.6.0 through 4.6.4 |
| CVE-2026-6868 | 7.5 | Apr 30 | Stack-based Buffer Overflow in Wireshark Affected: 4.4.0 before 4.4.15; 4.6.0 before 4.6.5 |
| CVE-2026-7378 | 7.5 | Apr 30 | Heap-based Buffer Overflow in Wireshark Affected: 4.4.0 before 4.4.15; 4.6.0 before 4.6.5 |
| CVE-2026-7379 | 7.5 | Apr 30 | Missing Release of Memory after Effective Lifetime in Wireshark Affected: 4.4.0 before 4.4.15; 4.6.0 before 4.6.5 |
| CVE-2026-7375 | 7.5 | Apr 30 | Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark Affected: 4.4.0 before 4.4.15; 4.6.0 before 4.6.5 |
| CVE-2026-7376 | 7.5 | Apr 30 | NULL Pointer Dereference in Wireshark Affected: 4.4.0 before 4.4.15; 4.6.0 before 4.6.5 |
| CVE-2026-3203 | 7.5 | Feb 25 | RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service Affected: 4.4.0 before 4.4.14; 4.6.0 before 4.6.4 |
| CVE-2026-3202 | 7.5 | Feb 25 | NTS-KE protocol dissector crash in Wireshark 4.6.0 to 4.6.3 allows denial of service Affected: 4.6.0 before 4.6.4 |
| CVE-2026-3201 | 7.5 | Feb 25 | USB HID protocol dissector memory exhaustion in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of service Affected: 4.4.0 before 4.4.14; 4.6.0 before 4.6.4 |
| CVE-2025-9817 | 7.5 | Sep 3 | SSH dissector crash in Wireshark 4.4.0 to 4.4.8 allows denial of service Affected: 4.4.0 through 4.4.8; 4.4.9 |
| CVE-2025-1492 | 7.5 | Feb 20 | Bundle Protocol and CBOR dissector crashes in Wireshark 4.4.0 to 4.4.3 and 4.2.0 to 4.2.10 allows denial of service via packet injection or crafted capture file Affected: 4.2.0 through 4.2.10; 4.4.0 through 4.4.3 |
| CVE-2024-9781 | 7.5 | Oct 10 | AppleTalk and RELOAD Framing dissector crash in Wireshark 4.4.0 and 4.2.0 to 4.2.7 allows denial of service via packet injection or crafted capture file Affected: 4.2.0 before 4.2.8; 4.4.0 |
| CVE-2024-4854 | 7.5 | May 14 | MONGO and ZigBee TLV dissector infinite loops in Wireshark 4.2.0 to 4.2.4, 4.0.0 to 4.0.14, and 3.6.0 to 3.6.22 allow denial of service via packet injection or crafted capture file Affected: 3.6.0 through 3.6.22; 4.0.0 through 4.0.14; 4.2.0 through 4.2.4 |
| CVE-2024-2955 | 7.5 | Mar 26 | T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file Affected: 4.0.0 before 4.0.14; 4.2.0 before 4.2.4 |
| CVE-2024-24479 | 7.5 | Feb 21 | A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/to_str.c, and format_fractional_part_nsecs components Affected: before 4.2.0 |
| CVE-2024-24476 | 7.5 | Feb 21 | A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr_resolv.c, and ws_manuf_lookup_str(), size components Affected: before 4.2.0 |
| CVE-2024-24478 | 7.5 | Feb 21 | An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_t*tvb, proto_tree*tree, packet_info*pinfo),… Affected: before 4.2.0 |
| CVE-2024-0211 | 7.5 | Jan 3 | DOCSIS dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file Affected: 4.2.0 |
| CVE-2024-0210 | 7.5 | Jan 3 | Zigbee TLV dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file Affected: 4.2.0 |
| CVE-2024-0209 | 7.5 | Jan 3 | IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file Affected: 3.6.0 through 3.6.19; 4.0.0 through 4.0.11; 4.2.0 |
| CVE-2024-0208 | 7.5 | Jan 3 | GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file Affected: 3.6.0 through 3.6.19; 4.0.0 through 4.0.11; 4.2.0 |
| CVE-2024-0207 | 7.5 | Jan 3 | HTTP3 dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file Affected: 4.2.0 |
| CVE-2023-4513 | 7.5 | Aug 24 | BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file Affected: 3.6.0 through 3.6.15; 4.0.0 through 4.0.7 |
| CVE-2023-4512 | 7.5 | Aug 24 | CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file Affected: 4.0.0 through 4.0.7 |
The 500 most important CVEs for this product (exploited first, then by severity)