Wireshark K12 RF5 File Parser Stack Buffer Overflow Vulnerability

Vulnerability Overview Vulnerability Name: K12 RF5 file parser stack buffer overflow Vulnerability Type: Stack buffer overflow Discoverer: bcoles Discovery Time: 1 month ago Status: Completed Impact Scope Affected Software: Wireshark, tshark, editcap Vulnerability Description: When exporting a K12 .rf5 file, the function copies the and strings into a stack-allocated 8192-byte buffer ( ) without checking the combined string length. This may lead to a 123 KB out-of-bounds write if a user opens and exports a specially crafted K12 file. Practical Exploitability: Due to default protection mechanisms enabled in Wireshark/tshark/editcap (such as stack canaries, hardened memory allocator, ASLR), the likelihood of practical exploitation is low. Remediation Plan AI Assistance: The vulnerability was identified using Claude Opus 4.6, but the root cause or mitigation measures have not yet been determined. Protection Analysis: - FORTIFY_SOURCE caught the first memory write (destlen=81f64) - Stack canary triggered at payload offset 8150 (protected build) - Without the above protections, RIP control would occur at payload offset 8204 POC Code Reproduction Steps 1. Run the POC script to generate a malicious K12 file 2. Open and export the file using Wireshark/tshark/editcap 3. Trigger the stack buffer overflow Additional Information Health Status: None Time Tracking: No estimated or spent time Participants: 4 people

Goal Reached Thanks to every supporter — we hit 100%!

Wireshark K12 RF5 File Parser Stack Buffer Overflow Vulnerability