CVE-2026-7379 Details
Description
Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service
A memory leak vulnerability has been identified in the Wireshark Sharkd utility, specifically in versions 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14. This vulnerability allows for a denial-of-service condition by causing excessive memory consumption. The issue arises because the 'cf_open' function in 'sharkd' does not properly free previously allocated resources before overwriting them. As a result, each load request can leak a significant amount of memory, estimated at around 440 KB, plus additional data from the loaded capture files. This unbounded memory growth can be triggered by an unauthenticated attacker sending repeated load requests through the Sharkd socket.
Users are advised to upgrade to Wireshark versions 4.6.5, 4.4.15 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.com/wireshark/wireshark/-/work_items/21214 | [email protected] | ExploitVendor Advisory |
| https://www.wireshark.org/security/wnpa-sec-2026-47.html | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wireshark wireshark | >= 4.4.0, < 4.4.15 >= 4.6.0, < 4.6.5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Initial Analysis | [email protected] |
| Apr 30, 2026 | New CVE Received | [email protected] |