CVE-2023-1161 in Wireshark
Summary
by MITRE • 03/06/2023
ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet injection or crafted capture file
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/07/2026
The vulnerability identified as CVE-2023-1161 represents a critical denial of service flaw within Wireshark's protocol dissectors for ISO 15765 and ISO 10681 communication standards. This issue affects Wireshark versions ranging from 4.0.0 through 4.0.3 and 3.6.0 through 3.6.11, creating a significant risk for network analysis and cybersecurity professionals who rely on this tool for protocol inspection. The vulnerability manifests when Wireshark processes network traffic or capture files containing malformed data specific to these automotive and industrial communication protocols, leading to application instability and potential system crashes.
The technical root cause of this vulnerability lies in insufficient input validation within the dissectors responsible for parsing ISO 15765 and ISO 10681 protocol frames. When encountering specially crafted packets or malformed capture files, the dissector functions fail to properly handle edge cases or invalid data structures, resulting in memory access violations or null pointer dereferences. This behavior aligns with CWE-125, which describes out-of-bounds read vulnerabilities, and CWE-476, which covers null pointer dereference conditions. The flaw specifically impacts the protocol analysis engine's ability to safely parse automotive communication standards commonly used in vehicle diagnostics and industrial automation systems.
The operational impact of this vulnerability extends beyond simple application crashes, as it creates potential disruption in network monitoring and forensic analysis operations. Security teams utilizing Wireshark for network traffic analysis, incident response, or protocol debugging could experience complete tool failure when processing traffic containing maliciously crafted ISO protocol data. This disruption is particularly concerning in automotive cybersecurity contexts where ISO 15765 (CAN-FD) and ISO 10681 (Vehicle Communication) protocols are extensively used for vehicle diagnostics, firmware updates, and telematics communications. The vulnerability creates an attack surface that could be exploited by adversaries to deny service to network monitoring systems, potentially masking malicious activities or disrupting critical infrastructure analysis.
Mitigation strategies for CVE-2023-1161 primarily involve immediate version updates to Wireshark 4.0.4 or 3.6.12, which contain patches addressing the input validation deficiencies in the affected dissectors. Network security teams should also implement additional protective measures such as validating capture files before processing, using automated tools to sanitize network traffic, and maintaining network segmentation to limit exposure. Organizations should consider implementing network monitoring solutions that can detect and alert on anomalous protocol behavior patterns. From an ATT&CK framework perspective, this vulnerability aligns with T1498, which covers network denial of service attacks, and T1566, which addresses malicious file execution through network protocols. The vulnerability demonstrates the importance of robust input validation in network analysis tools and highlights the critical need for security updates in widely used forensic and monitoring software.