CVE-2026-3202: Wireshark NTS-KE Parser Flaw Triggers Crash, Disrupting Network Analysis Workflows

Wireshark NTS-KE Dissector Crash – Denial of Service

CVE ID: CVE-2026-3202
Affected Product: Wireshark
Affected Versions: 4.6.0 through 4.6.3
Fixed Version: 4.6.4
Vulnerability Type: NULL Pointer Dereference
Impact: Application Crash (Denial of Service)
CVSS v3.1 Base Score: 6.5 (Medium)
Attack Vector: Local / User Interaction Required
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High (Application Termination)
Exploit Availability: No public weaponized exploit observed

Technical Description

A flaw was identified in the NTS-KE (Network Time Security – Key Establishment) dissector component of Wireshark. The issue originates from improper validation of parsed structures during protocol dissection. When malformed or incomplete NTS-KE data is processed, a NULL pointer may be dereferenced, causing the Wireshark process to terminate unexpectedly.

The vulnerability exists within the protocol parsing layer. Wireshark dissectors are responsible for interpreting network packets and converting raw bytes into structured protocol fields. In this case, insufficient pointer validation inside the NTS-KE dissector allows crafted packet fields to trigger a segmentation fault.

The issue does not permit remote code execution. The outcome is limited to application crash. However, in operational environments where Wireshark or tshark is used for monitoring, automation, forensic processing, or SOC pipelines, repeated crashes may disrupt analysis workflows.

Affected Protocol Context

NTS-KE operates over:

TCP Port: 4460
Transport Security: TLS
ALPN Identifier: ntske/1

Because Wireshark parses TLS extensions and NTS-KE payload structures, malformed handshake data or corrupted NTS-KE records can trigger the crash condition.

Root Cause Analysis

The vulnerability is classified under:

CWE-476 – NULL Pointer Dereference

During dissection of specific NTS-KE record types:

Expected structures are assumed to exist.
Under crafted conditions, pointer allocation may not occur.
The dissector attempts to access a field from an uninitialized pointer.
A segmentation fault (SIGSEGV) is triggered.
The Wireshark process terminates.

No memory corruption leading to arbitrary execution has been demonstrated. The flaw is limited strictly to process termination.

Exploitation Scenarios

Scenario 1 – Malicious PCAP File

An attacker crafts a malformed NTS-KE session.
Traffic is captured and exported into a .pcap file.
The file is delivered via email, file-sharing platform, or phishing campaign.
A user opens the capture in a vulnerable Wireshark version.
Wireshark crashes during packet parsing.

This is the most realistic exploitation method.

Scenario 2 – Live Network Injection

The attacker injects malformed NTS-KE traffic into a monitored network.
A security analyst captures live traffic using Wireshark.
During dissection of the malicious handshake, the crash occurs.

This requires network proximity or ability to inject packets.

Proof of Concept (Educational)

No official exploit toolkit is publicly circulating. However, a crash can be simulated in a controlled lab environment by:

Establishing a TLS session to TCP/4460.
Injecting malformed NTS-KE record structures.
Corrupting extension lengths or record identifiers.

Example concept:

Modify TLS extension length fields.
Insert malformed NTS-KE record types with inconsistent size declarations.
Provide truncated payloads where structures are expected.

Opening the generated PCAP in Wireshark 4.6.0–4.6.3 may cause a segmentation fault.

This information is provided strictly for defensive research and validation.

Indicators of Exploitation

Host-Based Indicators

Wireshark or tshark process terminates unexpectedly.
Segmentation fault (Linux/macOS).
Windows Application Error events referencing:
- wireshark.exe
- tshark.exe
Crash dumps referencing NTS-KE or packet dissection functions.

Network-Based Indicators

Unusual traffic on TCP/4460.
TLS Client Hello containing ALPN value ntske/1.
Incomplete or malformed TLS handshakes.
Abnormal packet length mismatches.
Repeated failed NTS-KE negotiations.

Detection Rules

Splunk – Wireshark Crash Detection (Windows)

index=wineventlog sourcetype=WinEventLog:Application 
(EventCode=1000 OR EventCode=1001)
| search Message="*wireshark*" OR Message="*tshark*"
| table _time host EventCode Message

Splunk – Suspicious NTS-KE Traffic

index=network sourcetype=netflow dest_port=4460 OR src_port=4460
| stats count by src_ip dest_ip dest_port
| where count > 50

Elastic (KQL) – Wireshark Crash Monitoring

event.code:(1000 or 1001) and process.name:(wireshark.exe or tshark.exe)

Suricata Rule – NTS-KE ALPN Detection

alert tcp any any -> any 4460 (msg:"NTS-KE TLS ALPN detected"; 
flow:established,to_server; content:"ntske/1"; nocase; 
classtype:protocol-command-decode; sid:4003202; rev:1;)

Zeek Detection Logic

Monitor TLS client hello events and log sessions where:

Destination port equals 4460
ALPN includes ntske/1

Alert on:

High frequency connections
Handshake failures
Abnormally short TLS sessions

Log Sources to Monitor

Windows Application Event Logs
Linux systemd journal
EDR process crash telemetry
IDS/IPS logs (Suricata, Snort)
Zeek TLS logs
NetFlow records
Packet capture automation systems

MITRE ATT&CK Mapping

Tactic: Impact
Technique: T1499 – Endpoint Denial of Service

The vulnerability enables service disruption at the endpoint level through crafted input.

Risk Assessment

Although exploitation requires user interaction or packet capture exposure, the vulnerability is relevant in:

SOC environments
Threat hunting platforms
Automated packet analysis pipelines
Malware research labs

Repeated crashes can disrupt investigations and delay response timelines.

Remediation

Immediate upgrade to the patched version is strongly recommended.

Official Patch / Upgrade Link:
https://www.wireshark.org/download.html

Upgrade to Wireshark 4.6.4 or later.

Temporary Mitigation

Disable the NTS-KE dissector in protocol preferences.
Avoid opening PCAP files from untrusted sources.
Use an isolated virtual machine for analyzing suspicious captures.
Run Wireshark as a non-privileged user.
Enable crash monitoring alerts in SIEM.

Incident Response Guidance

If exploitation is suspected:

Preserve the triggering PCAP file.
Capture crash dumps.
Isolate analysis workstation.
Upgrade immediately.
Review inbound file delivery mechanisms.
Check for repeated traffic patterns to TCP/4460.
Document timeline for SOC review.

Security Impact Summary

CVE-2026-3202 does not enable data theft or system compromise. The issue strictly affects availability of the Wireshark application. However, in operational environments, tool availability is critical. Even medium-severity parser vulnerabilities should be treated seriously in analysis infrastructure.

Upgrading eliminates the risk entirely, as the NULL pointer validation has been corrected in the patched release.