CVE-2026-6535Disclosure(wireshark / wireshark)

LOWCVSS 5.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Dissection engine zlib decompression crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

wireshark CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://gitlab.com/wireshark/wireshark/-/issues/21097

Vendor / third-party advisories

https://www.wireshark.org/security/wnpa-sec-2026-26.html

Other references

https://gitlab.com/wireshark/wireshark/-/issues/21098

Weakness type (CWE)

CWE-1325

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

wireshark

Threat summary

5 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 5 signals
Disclosure: 5 classified signals
Peaked 2d ago at 2 mentions (2026-04-30); latest day: 2
5 total mentions across 3 days

Affected systems

Vendors

wireshark

Products

wireshark

Deep dive

Activity timeline5 mentions / 3d

Signal classification1 categories

Disclosure

5100.0%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-30	2	Disclosure2
2026-05-30	1	Disclosure1
2026-06-01	2	Disclosure2

Full discourse5 posts

Lyrie.ai@lyrie_ai130d
Disclosure
Two critical flaws affect Wireshark's core dissection engine: zlib Decompression Crash (CVE-2026-6535) — Any protocol using zlib compression vulnerable LZ77 Decompression Crash (CVE-2026-6533) — Any protocol using LZ77 compression vulnerable
Post summary
The text announces the discovery of two critical decompression crash vulnerabilities in Wireshark's engine, providing brief technical descriptors but no PoC, exploit, patch, or evidence of active exploitation.
1000049
239 followersView on X
Lyrie.ai@lyrie_ai130d
Disclosure
zlib and LZ77 decompression flaws (CVE-2026-6535, CVE-2026-6533) affect any compressed protocol, expanding the attack surface beyond individual dissectors. A single malformed zlib payload can corrupt the dissection engine's state.
Post summary
The text announces CVE-2026-6535 and CVE-2026-6533, detailing how malformed zlib/LZ77 payloads can corrupt dissection engines across compressed protocols.
1000048
239 followersView on X
Lyrie.ai@lyrie_ai131d
Disclosure
Two vulnerabilities target Wireshark's core dissection engine, not individual parsers: LZ77 Decompression Crash (CVE-2026-6533) — Compressed payloads corrupt the decompression pipeline zlib Decompression Crash (CVE-2026-6535) — Malformed zlib streams crash the engine
Post summary
The text reports two Wireshark core engine vulnerabilities, CVE-2026-6533 (LZ77 decompression crash) and CVE-2026-6535 (zlib decompression crash), that cause crashes when encountering maliciously crafted compressed payloads.
1000053
232 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds161d
Disclosure
CVE-2026-6535 Denial of Service via zlib Decompression Crash in Wireshark 4.6.0-4.6.4 a... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-6535 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The text announces that Wireshark versions 4.6.0-4.6.4 have a denial‑of‑service vulnerability (CVE‑2026‑6535) caused by a zlib decompression crash; no PoC, exploit code, or patch details are provided.
0000040
4.0K followersView on X
CVE@CVEnew161d
Disclosure
CVE-2026-6535 Dissection engine zlib decompression crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service https://www.cve.org/CVERecord?id=CVE-2026-6535
Post summary
The text discloses that CVE-2026-6535 is a zlib decompression crash in Wireshark leading to denial-of-service, without mention of exploits, patches, or active attacks.
0000091
57.3K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	wireshark	wireshark	-	-	-

Explore more

Back to dashboard wireshark CVEs wireshark vulnerabilities

What researchers are saying

CVE-2026-6535

Lyrie.ai[verified]@lyrie_aiDisclosure

The text announces the discovery of two critical decompression crash vulnerabilities in Wireshark's engine, providing brief technical descriptors but no PoC, exploit, patch, or evidence of active exploitation.

Lyrie.ai[verified]@lyrie_aiDisclosure

The text announces CVE-2026-6535 and CVE-2026-6533, detailing how malformed zlib/LZ77 payloads can corrupt dissection engines across compressed protocols.

Lyrie.ai[verified]@lyrie_aiDisclosure

The text reports two Wireshark core engine vulnerabilities, CVE-2026-6533 (LZ77 decompression crash) and CVE-2026-6535 (zlib decompression crash), that cause crashes when encountering maliciously crafted compressed payloads.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The text announces that Wireshark versions 4.6.0-4.6.4 have a denial‑of‑service vulnerability (CVE‑2026‑6535) caused by a zlib decompression crash; no PoC, exploit code, or patch details are provided.

CVE@CVEnewDisclosure

The text discloses that CVE-2026-6535 is a zlib decompression crash in Wireshark leading to denial-of-service, without mention of exploits, patches, or active attacks.