ZDI-26-899: Wireshark LBMC Fragment Reassembly Integer Overflow Remote Code Execution Vulnerability

Published Nov 10, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Wireshark. Authentication is not required to exploit this vulnerability. However, only instances with LBMC fragment reassembly enabled are vulnerable. The ZDI has assigned a CVSS rating of 7.5.

Event History

Nov 10, 2026

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

Which Wireshark deployments are exposed to this vulnerability?

Only installations with LBMC fragment reassembly enabled are vulnerable. Instances where this feature is not enabled are not identified as affected by the provided advisory.

What level of access does an attacker need to exploit the issue?

Authentication is not required. A remote attacker can exploit the vulnerability to execute arbitrary code on an affected installation.

ZDI-26-899: Wireshark LBMC Fragment Reassembly Integer Overflow Remote Code Execution Vulnerability

Event History

Frequently Asked Questions

Which Wireshark deployments are exposed to this vulnerability?

What level of access does an attacker need to exploit the issue?

Company

Resources

Contact

Frequently Asked Questions

Which Wireshark deployments are exposed to this vulnerability?

What level of access does an attacker need to exploit the issue?