CVE-2026-6519 — Denial of Service

title: Potential Wireshark MBIM Dissector Crash (CVE-2026-6519)
id: scw-2026-04-30-ai-1
status: experimental
level: high
description: |
  This rule detects the execution of Wireshark's tshark utility with the MBIM dissector enabled, which is known to be vulnerable to a denial of service (infinite loop) in specific versions of Wireshark (4.6.0-4.6.4 and 4.4.0-4.4.14). This could indicate an attempt to trigger the vulnerability by processing a crafted MBIM capture file.
author: SCW Feed Engine (AI-generated)
date: 2026-04-30
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-6519/
tags:
  - attack.impact
  - attack.t1499
logsource:
    category: process_creation
detection:
  selection:
      Image|startswith:
          - 'C:\Program Files\Wireshark\wireshark.exe'
      ParentImage|startswith:
          - 'C:\Program Files\Wireshark\tshark.exe'
      CommandLine|contains:
          - '-r'
          - '-Y "mbim"'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse