A protocol-valid, packet-controlled RB-Identity value in the UMTS RRC dissector is stored in RRC private state and later used directly as an index into rrc_ciphering_info.seq_no, whose...

From AISLE Research: [Security] CMS MessageDigest verification dereferences missing algorithm

Summary Heap out-of-bounds read in the Bluetooth ATT dissector when handling Read Multiple Variable Response (opcode 0x21). The...

Summary Heap out-of-bounds write in the Catapult DCT2000 wiretap file reader at catapult_dct2000.c:1382. floor(data_chars/2) bytes are allocated but...

Summary The ERF metadata parser copies an eight-byte gen_time value without checking that the tag contains eight value...

Summary The Tektronix K12 .rf5 reader can pass a length larger than its record buffer to process_packet_data().

From AISLE Security: [Security] EAX CMAC 16-bit length truncation can overflow heap on large C12.22 cleartext-auth payloads

Daniel Birtwhistle reported the following: Case: WS-REASM-WRAP-01 Audience: Wireshark security team Hello Wireshark Security Team, My name is Daniel Birtwhistle....

I am writing to report a stack-buffer-overflow (write) that is triggerable by way of the Wireshark fuzzing harness fuzzshark) This is a security issue that...

Summary The UMTS FP dissector does not limit the number of MAC-is SDU descriptors before using the count...

I am writing to report stack-use-after-return in tshark sharkd This is a security issue that was found by Anthropic using Claude to find...

I am writing to report stack-use-after-return in tshark sharkd This is a security issue that was found by Anthropic using Claude to find...

AVRCP Vendor-Dependent Fragment Reassembly — uint32_t Integer Overflow → Heap Buffer Overflow 1. Executive Summary

Affected: master, release-4.6, release-4.4. Introduced in 3.4.0 (2020-10-29) with SSH decryption support; unfixed on every branch as of 2026-08-02. Impact: heap out-of-bounds write of...

From AISLE Security: Summary A malformed BER BIT STRING in an ESS security-category attribute can make...

From Aisle Security: [Security] 3GPP log decoder writes one byte past packet buffer

From AISLE Security: [Security] CMS RC2 parameter decoding reuses freed capability-tree pointer

Aisle Security reported: [Security] BR/EDR fragmented L2CAP uses an unregistered reassembly table

From AISLE Security: [Security] Short +XAPL accessory parameter causes heap out-of-bounds read

From AISLE Security: [Security] Kerberos learned-key formatting reads past short EncryptionKey

From AISLE Security: [Security] H.245 returnedFunction nested GenericMessage dereferences NULL packet state