RDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and possible code execution

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6249 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6249-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     May 06, 2026                          https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : wireshark     CVE ID         : CVE-2026-5299 CVE-2026-5401 CVE-2026-5403 CVE-2026-5404                      CVE-2026-5405 CVE-2026-5406 CVE-2026-5407 CVE-2026-5408                      CVE-2026-5409 CVE-2026-5653 CVE-2026-5654 CVE-2026-5656                      CVE-2026-5657 CVE-2026-6519 CVE-2026-6520 CVE-2026-6521                      CVE-2026-6522 CVE-2026-6523 CVE-2026-6524 CVE-2026-6527                      CVE-2026-6529 CVE-2026-6530 CVE-2026-6531 CVE-2026-6532                      CVE-2026-6533 CVE-2026-6534 CVE-2026-6535 CVE-2026-6537                      CVE-2026-6538 CVE-2026-6867 CVE-2026-6868 CVE-2026-6869                      CVE-2026-6870 CVE-2026-7375 CVE-2026-7376 CVE-2026-7378                      CVE-2026-7379

    Multiple vulnerabilities have been discocvered in Wireshark, a network     protocol analyzer which could result in denial of service or the     execution of arbitrary code.

    For the oldstable distribution (bookworm), a subset of these problems     have been fixed in version 4.0.17-0+deb12u3.

    For the stable distribution (trixie), these problems have been fixed in     version 4.4.15-0+deb13u1.

    We recommend that you upgrade your wireshark packages.

    For the detailed security status of wireshark please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/wireshark

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - RDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service and     possible code execution (CVE-2026-5405)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 4.4.15. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.4.15 advisory.

  - RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of     service (CVE-2026-3203)

  - GSM RP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-6870)

  - Monero protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-5409)

  - BT-DHT protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-5408)

  - FC-SWILS protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-5406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote Windows host is prior to 4.4.15. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.4.15 advisory.

  - RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of     service (CVE-2026-3203)

  - GSM RP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-6870)

  - Monero protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-5409)

  - BT-DHT protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-5408)

  - FC-SWILS protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-5406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 4.6.5. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.6.5 advisory.

  - RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of     service (CVE-2026-3203)

  - GSM RP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-6870)

  - Monero protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-5409)

  - BT-DHT protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-5408)

  - FC-SWILS protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-5406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Wireshark installed on the remote Windows host is prior to 4.6.5. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.6.5 advisory.

  - RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of     service (CVE-2026-3203)

  - GSM RP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-6870)

  - Monero protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-5409)

  - BT-DHT protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-5408)

  - FC-SWILS protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service     (CVE-2026-5406)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
313009	Debian dsa-6249 : libwireshark-data - security update	Nessus	Debian Local Security Checks	high
311663	Linux Distros Unpatched Vulnerability : CVE-2026-5405	Nessus	Misc.	high
311437	Wireshark 4.4.x < 4.4.15 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high
311436	Wireshark 4.4.x < 4.4.15 Multiple Vulnerabilities	Nessus	Windows	high
311427	Wireshark 4.6.x < 4.6.5 Multiple Vulnerabilities (macOS)	Nessus	MacOS X Local Security Checks	high
311426	Wireshark 4.6.x < 4.6.5 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2026-5405

high

Tenable Plugins

high

high

high

high

high

high