Wireshark: RCE Vulnerability in RF4CE Parser, Patch Available

On September 23, 2026, the Trend Micro Zero Day Initiative publicly disclosed vulnerability ZDI-26-747, a remote code execution flaw in Wireshark's RF4CE parser. The vendor notification dates to September 10, 2026: a thirteen-day window that allowed Wireshark to prepare and release a corrective update before coordinated disclosure. The flaw affects a tool installed on millions of workstations used by security professionals and network administrators.

The Buffer Overflow Mechanism in the RF4CE Parser

The ZDI-26-747 advisory precisely identifies the attack surface: the parsing of key exchange packets for the RF4CE (Radio Frequency for Consumer Electronics) protocol, a Zigbee profile used in remote controls, smart home systems, and low-power consumer devices. The protocol carries cryptographic handshake data between peripherals that analysts routinely capture and inspect with Wireshark.

According to the advisory's technical description, "the specific flaw exists within the parsing of RF4CE key exchange packets." The advisory continues: "The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer." The result is a writable buffer overflow that allows a remote attacker to execute arbitrary code in the context of the Wireshark process.

The vector is particularly insidious because it exploits a file format — pcap or pcapng — that security analysts open daily without suspicion. A seemingly legitimate network capture file containing maliciously crafted RF4CE packets becomes a vehicle for compromising the analyst's workstation.

"This vulnerability allows remote attackers to execute arbitrary code on affected installations of Wireshark." — Trend Micro Zero Day Initiative, Advisory ZDI-26-747

RF4CE: A Domestic Protocol That Reaches the Analyst's Desktop

RF4CE operates in the 2.4 GHz band, the same as Zigbee and Wi-Fi, and is designed for short-range communications with minimal latency requirements: TV remote controls, lighting systems, thermostats, locks. For a network analyst, these packets are routine. They are captured, archived, shared among teams, and attached to incident response tickets.

The vulnerability shifts the risk perimeter from the IoT device to the workstation analyzing it. The analyst does not need to possess RF4CE hardware: simply opening a capture file containing malicious packets is sufficient. The transformation chain is file → Wireshark parser → buffer overflow → code execution in the application process. The execution context matters: Wireshark often runs with elevated privileges to capture on network interfaces, and even when not elevated, the process has access to sensitive resources in the user session.

User Interaction and Exploit Conditions

The ZDI advisory explicitly states that "user interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file." The interaction requirement rules out a zero-click scenario but does not mitigate the risk in real-world operational environments. Security analysts open pcap files from external sources — colleagues, clients, public repositories, incident response emails — with a frequency that makes the vector socially credible.

The malicious web page introduces a second vector: the automatic download of a capture file that the user subsequently opens, or that in some browsers and configurations opens directly in the associated application. The attack perimeter expands from the malware analysis lab to the normal workflow of a SOC.

Coordinated Timeline and CVE Status

The timeline is documented by the primary advisory: vendor notification on September 10, 2026, coordinated public release on September 23, 2026. Thirteen days of coordination window align with standard ZDI procedure, which provides for disclosure after remediation or expiration of the agreed term.

The associated CVE is CVE-2026-96417. The record is in reserved status: the identifier is assigned but details are not yet populated by the CNA (CVE Numbering Authority). This means the CVSS score, scoring vector, and specific affected versions are not available in the official record at the time of publication. The ZDI advisory does not report an independent CVSS score, leaving this metric undetermined.

The researcher who discovered the flaw is identifiable with high probability but not absolute certainty. The upcoming ZDI-CAN-31780 list, related to Wireshark with a reporting date of 2026-09-10, attributes the discovery to Meshaal (@unrealmesh). The temporal and product correspondence supports the identification, but advisory ZDI-26-747 does not confirm it explicitly.

What to Do Now

Wireshark has released an update to fix the vulnerability: the primary source states this without reservation. Users must verify the availability of the corrected version through the project's official channels.

Priority operational measures derive directly from the documented facts:

• Verify the installed Wireshark version and compare it with the available update; the source does not specify the patched version number, which must be found in the official release notes.
• Treat network capture files from untrusted sources as potential attack vectors until patch application is verified, given that user interaction is the exploit trigger.
• Evaluate opening pcap files in isolated or sandboxed environments when the source is external or unverifiable, considering that the RF4CE parser is the vulnerable component.
• Monitor the CVE-2026-96417 record for the population of technical details and the CVSS score, currently unavailable.

When the Lab Becomes the Target

This vulnerability inverts the usual direction of IoT attacks. The attacker does not compromise the home device to move laterally: they use the home device as bait to compromise the analyst studying it. The security professional, armed with Wireshark to inspect RF4CE traffic, becomes the attack surface themselves.

The pattern aligns with an evolution of supply chain vectors and work tools: attacking analysis toolchains has a multiplicative effect, because a compromised analyst can propagate access to multiple client environments. The pcap file shared in a team, uploaded to a collaboration platform, attached to a report: every node becomes a potential entry point.

The thirteen-day window between notification and disclosure is relatively short, suggesting the fix did not encounter significant technical obstacles. The absence of in-the-wild exploit details in the dossier does not exclude the emergence of proof-of-concept vectors: the nature of the defect — a buffer overflow with attacker-controlled data in a file parser — is a well-documented exploit surface in security literature.

The concrete impact depends on the operational posture of organizations that use Wireshark as a first-resort tool. Automatic opening of capture files, lack of sandboxing for analysis sessions, execution with elevated privileges for capture: these common practices amplify the severity of a vulnerability that, on paper, requires only a user click.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-747/
• http://www.zerodayinitiative.com/advisories/published/
• https://www.cve.org/CVERecord?id=CVE-2026-96417
• http://www.zerodayinitiative.com/advisories/upcoming/
• https://gitlab.com/wireshark/wireshark/-/commit/b2d359a23f9557d1740ded6b5e71ec8eea4b1695
• https://www.trendmicro.com/

Information has been verified against cited sources and updated at the time of publication.

Sources