CVE-2026-6524 in Wireshark
Summary
by MITRE • 04/30/2026
MySQL protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/18/2026
The vulnerability involves a critical crash in Wireshark's MySQL protocol dissector affecting versions 4.6.0 through 4.6.4 and 4.4.0 through 4.4.14. This issue represents a denial of service condition where maliciously crafted network traffic can cause Wireshark to crash when processing MySQL protocol packets. The flaw specifically targets the dissector component responsible for parsing and analyzing MySQL network traffic, which is commonly used by network security professionals for protocol analysis and troubleshooting. When Wireshark encounters malformed or specially crafted MySQL packets during packet capture analysis, the dissector fails to handle the input properly, leading to an application crash that terminates the analysis session. This vulnerability directly impacts the reliability of network monitoring operations where Wireshark serves as the primary packet analysis tool for database traffic inspection.
The technical root cause stems from insufficient input validation within the MySQL protocol dissector implementation. The dissector lacks proper bounds checking and error handling mechanisms when processing MySQL protocol headers and data structures. This allows attackers to craft packets that trigger buffer overflows, null pointer dereferences, or other memory corruption conditions within the dissector code. The vulnerability aligns with CWE-121, which describes heap-based buffer overflow conditions, and CWE-125, which covers out-of-bounds read errors. When Wireshark attempts to parse malicious MySQL packets, the dissector code fails to properly validate packet structure elements such as packet lengths, sequence numbers, or command identifiers, causing the application to crash during the parsing phase. This type of vulnerability falls under the ATT&CK technique T1499.004, which involves network disruption through application or system crashes.
The operational impact of this vulnerability extends beyond simple application instability to compromise network monitoring capabilities and security operations. Security analysts and network administrators who rely on Wireshark for database traffic analysis face significant disruption when encountering malicious traffic, as their analysis sessions suddenly terminate without warning. This vulnerability particularly affects environments where MySQL traffic monitoring is critical, including database security auditing, performance troubleshooting, and network forensics investigations. Organizations using Wireshark for continuous network monitoring may experience unexpected service interruptions, potentially masking actual security incidents or network anomalies. The denial of service condition can be exploited remotely by attackers who send malicious MySQL packets to network monitoring systems, effectively disabling the network analysis capabilities without requiring elevated privileges or authentication. This makes the vulnerability particularly dangerous in operational technology environments where continuous monitoring is essential for security posture maintenance.
Mitigation strategies should focus on immediate version updates to Wireshark 4.6.5 or 4.4.15, which contain patches addressing the MySQL dissector crash vulnerability. Network administrators should implement network segmentation and traffic filtering to prevent unauthorized access to monitoring systems, reducing the attack surface for exploitation attempts. Organizations should also consider implementing additional monitoring solutions to detect and alert on Wireshark crashes or abnormal network behavior that might indicate exploitation attempts. The patch addresses the specific memory handling issues within the MySQL dissector by adding proper input validation and bounds checking for all packet parsing operations. Security teams should conduct vulnerability assessments to identify systems running affected Wireshark versions and prioritize remediation efforts based on network monitoring criticality. Additionally, implementing network traffic inspection rules that filter known malicious MySQL packet patterns can provide additional protection layers while waiting for patch deployment.