Wireshark RDP Dissector Crash (CVE-2026-5405) Allows DoS, Potential RCE

The National Vulnerability Database has issued an advisory for CVE-2026-5405, detailing a critical vulnerability in Wireshark’s RDP protocol dissector. This flaw, present in versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14, could lead to a denial of service (DoS) and potentially remote code execution (RCE). The vulnerability stems from a crash in the RDP dissector, indicating a memory corruption issue likely related to improper handling of malformed RDP traffic.

Rated with a CVSS score of 7.8 (HIGH), this vulnerability has significant implications for analysts and security teams who rely on Wireshark for network traffic analysis. An attacker could craft malicious RDP traffic that, when analyzed by a vulnerable Wireshark instance, could crash the application. The “possible code execution” aspect is particularly concerning; it suggests that with further exploitation, an attacker might achieve arbitrary code execution on the analyst’s workstation, turning a passive analysis tool into an active attack vector.

Defenders must understand the attacker’s calculus here: targeting the tools used by security professionals is a high-value objective. If an attacker can compromise an analyst’s machine, they gain a foothold into internal networks or access to sensitive intelligence. Organizations should prioritize patching Wireshark instances immediately. If patching isn’t feasible, consider isolating Wireshark analysis environments and ensuring they are not exposed to untrusted network segments or unvalidated capture files.