VCA-MINI-WIRESHARK-CVES-2026-05: Wireshark / tshark RCE Quartet (May 2026)

Module code: VCA-MINI-WIRESHARK-CVES-2026-05 Belt level: 3/5 (vocabulary mini-module) Duration: one week; 4 sessions of 60-90 minutes each Format: lecture + guided pcap lab + check-for-understanding rubric Prerequisites: packet-capture analysis foundation (NET-101 or equivalent); Wireshark UI familiarity. No exploit-development background required.

What this module is

Four real CVEs disclosed against Wireshark and tshark in May 2026, all patched in Wireshark 4.6.5 and 4.4.15. The quartet covers four distinct bug shapes: heap overflow via integer truncation, heap overflow via loop accounting failure, heap overflow via missing fast-path bounds check, and path-traversal-to-RCE via zip-slip. That cross-CVE structural comparison is the pedagogical value: students leave with vocabulary for four named shapes anchored on real disclosures.

The companion handout (cve-lab-wireshark-rce-quartet-2026-05.md) is the primary student reading material. This classroom unit delivers the lecture framing, guided lab, and rubric that turn the handout into a graded module.

Lab-target discipline: all hands-on work runs against lab-owned Wireshark 4.6.4 inside the academy fwlab container, or against pre-recorded .pcapng files from the academy pcap-tools catalog (/pcap-tools/ under the cve-quartet-2026-05/ prefix). Production analyst workstations are never the target.

Learning objectives

A student who completes this module can do five things:

1. Recognize each of the four bug shapes when they appear in future CVEs against Wireshark or other parser codebases. The shapes have names: integer-truncation heap overflow, loop-accounting-failure heap overflow, asymmetric-fast-path heap overflow, zip-slip-to-RCE.

2. Locate the specific dissector files and functions where each CVE lives: epan/packet-tls.c (TLS ECH transcript reconstruction), plugins/codecs/sbc/sbc.c (SBC decode loop), epan/tvbuff_rdp.c (ZGFX uncompressed path), ui/qt/utils/wireshark_zip_helper.cpp (profile ZIP extraction).

3. Defend at the SOC layer: write Suricata rules for the three network-observable shapes, configure capture-file sandboxing for untrusted .pcapng files, and recommend tshark-vs-Wireshark surface-area trade-offs to colleagues.

4. Discuss the disclosures intelligently with vendors, colleagues, and customers. Belt-3 graduates read Wireshark advisories fluently.

5. Forward to the correct advanced course for patch-diff and exploit-primitive work. The RE-101 binary-diff lab cluster (re-101-cve-quartet-binary-diff-lab-cluster.md) and the ADV-101 capstone arc (adv-101-cve-2026-5402-capstone-arc.md) are the next steps for students continuing up the ladder.

Session plan

Sessions 1-4 follow the lecture notes in week-1-wireshark-rce-quartet.md. The guided pcap lab (labs/lab-1-pcap-analysis.md) runs in parallel with sessions 1-3 (hands-on after each session's lecture segment) and independently for session 4.

Equipment and tool requirements

Virtual path (no fwlab access): all four labs can run against the pre-recorded .pcapng files in the academy pcap-tools catalog using patched Wireshark 4.6.5. The pre-recorded files trigger the vulnerable code paths when opened in 4.6.4 but are safe to inspect in 4.6.5. Instructors can distribute the files or point students to the catalog.

Companion handouts

Reading assignment before Session 1: companion handout §0.5 (lab scope) and §5 (cross-CVE shape comparison). Students who read the shape-comparison table first arrive with the right frame for what the four sessions will fill in.

Check-for-understanding rubric (10 points)

These are take-home short-answer questions, submitted after the final session. The rubric tests vocabulary from all four CVEs and the defensive synthesis. Students answer in writing; answers should be 1-4 sentences each.

Question 1 (2 points)

CVE-2026-5402 involves three arithmetic defects that compound to produce the heap overflow. Name all three.

Full credit (2 pts): Names uint16_t truncation in extensions_end, uint16_t truncation in outer_offset, and unsigned underflow (wrapping to UINT_MAX) in the hello_length bounds check. Any equivalent phrasing accepted. Partial credit (1 pt): Names two of the three defects accurately.

Question 2 (2 points)

CVE-2026-5403 is described as a "loop accounting failure" rather than a "missing bounds check." In one sentence, explain the difference.

Full credit (2 pts): States that a missing-bounds-check bug skips a length validation before a copy; a loop-accounting-failure bug performs the copy correctly in each individual iteration but never tracks remaining output capacity across iterations, so the cumulative write eventually overflows the buffer. Any equivalent phrasing accepted. Partial credit (1 pt): Correctly identifies that the CVE-5403 bug involves loop state, not a missing single check, but does not explain the distinction from a simple missing bounds check.

Question 3 (2 points)

CVE-2026-5405 has an "asymmetric validation" shape. Name the two code paths and state which one lacks bounds checking.

Full credit (2 pts): Names the compressed-ZGFX path (bounds-checked) and the uncompressed-ZGFX path (unbounded tvb_memcpy, no length validation against the 65 536-byte output buffer). States clearly that the uncompressed path is the vulnerable one. Partial credit (1 pt): Identifies the two paths but reverses which is checked or does not name the specific function/constant.

Question 4 (2 points)

CVE-2026-5656 is a two-step exploit chain. What are the two architectural features of Wireshark that combine to make the zip-slip primitive RCE rather than just a file-write?

Full credit (2 pts): Step 1: the ZIP extraction code in WiresharkZipHelper::unzip() does not validate that extracted paths stay within the profile directory (the zip-slip primitive). Step 2: Wireshark auto-loads any .lua file in the per-profile plugin directory on startup (the auto-execute architectural decision). Both features named. Partial credit (1 pt): Identifies zip-slip but does not identify the Lua auto-load step, or vice versa.

Question 5 (2 points)

For any one of the four CVEs, name the first-priority mitigation a SOC analyst should apply within 24 hours of reading the advisory, and explain in one sentence why it is first priority over the other mitigations.

Full credit (2 pts): For any CVE: names patching to Wireshark 4.6.5 / 4.4.15 as first priority. Explanation must note that the patch closes the bug directly; the other mitigations (sandboxing, preference disabling, rule deployment) reduce exposure but do not fix the root cause. Any equivalent phrasing accepted. Partial credit (1 pt): Names the correct mitigation but does not explain prioritization, or names a secondary mitigation with a plausible but incomplete rationale.

Lab grading summary

See labs/lab-1-pcap-analysis.md for the full lab spec and per-part grading.

Cross-track context

This module is referenced by six courses in the academy curriculum. The usage varies by course depth:

A26 Network-Analyst track uses all four CVEs for protocol-state-machine analysis methodology. Forward-pointer to /workbench/fsm/ for FSM-viz tooling.