ANT-2026-F8AZ7X04 · wireshark/wireshark

global-buffer-overflow high

Severity Claude critical · Security research firm high · Maintainer -

Discovered by Claude Opus 4.6

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-F8AZ7X04: global-buffer-overflow in wireshark

In Wireshark's MACsec dissector (epan/dissectors/packet-macsec.c), dissect_macsec() calls tvb_memcpy() at line 640 to copy packet bytes into the static global buffer 'aad' (declared at packet-macsec.c:106, size 1514). A crafted Ethernet frame with EtherType 0x88E5 inside a pcapng file causes a 1501-byte memcpy that lands past the right edge of 'aad', corrupting adjacent global memory. The attacker controls the frame length and contents, so both the overflow size and the bytes written are attacker-influenced. This yields an out-of-bounds write into the .bss/.data segment whenever the malicious capture is opened in tshark or Wireshark.

Target

Project: wireshark
Commit: 7ad7e74628e14444
Location: tvbuff.c:1054

Technical Details

ASAN: "WRITE of size 1501 at 0x7fd93f3b094a ... 0 bytes to the right of global variable 'aad' ... of size 1514". The dissector uses a fixed 1514-byte global as the AAD staging buffer but derives the copy length/offset from the incoming tvb without clamping to sizeof(aad), so an oversized or specially-shaped MACsec frame drives tvb_memcpy() to write beyond the buffer's end.

Crash trace (truncated — full trace in attached crash.log):

==10340==ERROR: AddressSanitizer: global-buffer-overflow on address 0x7fd93f3b094a at pc 0x560a96763f8a bp 0x7ffd5708ac00 sp 0x7ffd5708a3d0
WRITE of size 1501 at 0x7fd93f3b094a thread T0
    #0 0x560a96763f89 in __asan_memcpy (/workspace/repo/build/run/tshark+0x10ef89)
    #1 0x7fd92fd41666 in tvb_memcpy /workspace/repo/epan/tvbuff.c:1054:10
    #2 0x7fd92dde3a58 in dissect_macsec /workspace/repo/epan/dissectors/packet-macsec.c:640:17
    #3 0x7fd92fc43dd2 in call_dissector_through_handle /workspace/repo/epan/packet.c:945:9
    #4 0x7fd92fc34bdd in call_dissector_work /workspace/repo/epan/packet.c:1036:9
    #5 0x7fd92fc353be in dissector_try_uint_with_data /workspace/repo/epan/packet.c:1766:8
    #6 0x7fd92fc353be in dissector_try_uint /workspace/repo/epan/packet.c:1790:9
    #7 0x7fd92d734d28 in dissect_ethertype /workspace/repo/epan/dissectors/packet-ethertype.c:300:21
    [... 20 more frames — full trace in crash.log]

Reproduction

  1. Craft a pcapng containing an Ethernet frame with EtherType 0x88E5 (MACsec) whose length/header fields force the AAD copy offset+length to exceed 1514 bytes
  2. Deliver the file to the victim (email, download, shared drive) or transmit the frame on a monitored network
  3. Victim runs tshark -r poc.pcapng or opens it in Wireshark
  4. dissect_macsec() invokes tvb_memcpy() into the global 'aad' buffer and writes past its end

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-F8AZ7X04.

Reference: ANT-2026-F8AZ7X04
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits.

Verdict
true positive
Severity
high
UPSTREAM FIX

The change that resolved this finding.

diff --git a/epan/dissectors/packet-macsec.c b/epan/dissectors/packet-macsec.c
index b3732d61626..262067f1b64 100644
--- a/epan/dissectors/packet-macsec.c
+++ b/epan/dissectors/packet-macsec.c
@@ -781,7 +781,7 @@ dissect_macsec(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void *data _
                 We have to build the AAD since the incoming TVB payload does not have the Ethernet header. */
             payload_len = frame_len - ETHHDR_LEN;
 
-            if (payload_len <= MAX_PAYLOAD_LEN) {
+            if (frame_len <= MAX_PAYLOAD_LEN) {
                 /* Copy the frame data up to the ICV. */
                 tvb_memcpy(tvb, &aad[ETHHDR_LEN], 0, payload_len);

https://github.com/wireshark/wireshark/commit/4a597d797cef5b1e256056f6e0feb15fcf3a56e0

TIMELINE

Dates from discovery through public reveal.

  1. 2026-03-26 Reported to tracker
  2. 2026-04-30 Patch released
  3. 2026-05-01 Sent to maintainer
  4. 2026-05-01 Maintainer acknowledged
  5. 2026-08-17 Publicly revealed
PROVENANCE

SHA-3-512 hash:

687c5edfcc577128a9fbe48a062dd91d6fa55437c9cea02c93e4769a591d8f04e9977438e04e64587aad735b76977219f152374c797fb8feaa89e08d74e16655

Committed 2026-05-01 00:02 PT

Revealed 2026-08-17 13:04 PT

Verify (download preimage.json)

Show preimage JSON 
{
  "ant_id": "ANT-2026-F8AZ7X04",
  "bug_class": "global-buffer-overflow",
  "claude_severity": "critical",
  "commit_sha": "7ad7e74628e14444",
  "created_at": "2026-03-27T02:13:06+00:00",
  "description": "In Wireshark's MACsec dissector (epan/dissectors/packet-macsec.c), dissect_macsec() calls tvb_memcpy() at line 640 to copy packet bytes into the static global buffer 'aad' (declared at packet-macsec.c:106, size 1514). A crafted Ethernet frame with EtherType 0x88E5 inside a pcapng file causes a 1501-byte memcpy that lands past the right edge of 'aad', corrupting adjacent global memory. The attacker controls the frame length and contents, so both the overflow size and the bytes written are attacker-influenced. This yields an out-of-bounds write into the .bss/.data segment whenever the malicious capture is opened in tshark or Wireshark.",
  "discovered_at": null,
  "location": "tvbuff.c:1054",
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "wireshark",
  "reproduction": [
    "1. Craft a pcapng containing an Ethernet frame with EtherType 0x88E5 (MACsec) whose length/header fields force the AAD copy offset+length to exceed 1514 bytes",
    "2. Deliver the file to the victim (email, download, shared drive) or transmit the frame on a monitored network",
    "3. Victim runs `tshark -r poc.pcapng` or opens it in Wireshark",
    "4. dissect_macsec() invokes tvb_memcpy() into the global 'aad' buffer and writes past its end"
  ],
  "technical_details": "ASAN: \"WRITE of size 1501 at 0x7fd93f3b094a ... 0 bytes to the right of global variable 'aad' ... of size 1514\". The dissector uses a fixed 1514-byte global as the AAD staging buffer but derives the copy length/offset from the incoming tvb without clamping to sizeof(aad), so an oversized or specially-shaped MACsec frame drives tvb_memcpy() to write beyond the buffer's end.",
  "title": "global-buffer-overflow in wireshark",
  "vendor_severity": "high"
}