CVE-2026-24028: Out-of-bounds read when parsing DNS packets via Lua
An attacker might be able to trigger an out-of-bounds read by sending a crafted DNS response packet, when custom Lua code uses newDNSPacketOverlay to parse DNS packets. The out-of-bounds read might trigger a crash, leading to a denial of service, or access unrelated memory, leading to potential information disclosure.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24028?
CVE-2026-24028 is classified as a high-severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2026-24028?
To mitigate CVE-2026-24028, update to the latest version of Wireshark as soon as a patch is released.
What type of attack does CVE-2026-24028 enable?
CVE-2026-24028 enables an attacker to exploit an out-of-bounds read vulnerability by sending a specially crafted DNS response packet.
Which software is affected by CVE-2026-24028?
CVE-2026-24028 affects Wireshark, particularly when custom Lua code is employed to parse DNS packets.
What are the potential consequences of CVE-2026-24028?
Exploitation of CVE-2026-24028 could lead to application crashes and result in service disruptions.