CVE-2026-15170 is a heap-based buffer overflow vulnerability in the Z39.50 protocol dissector component of Wireshark Foundation's Wireshark software. It affects versions 4.6.0 through 4.6.6 and 4.4.0 through 4.4.16. Exploitation of this vulnerability leads to a crash of the Wireshark application, causing denial of service. The CVSS 3.1 base score is 5.5, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, user interaction required, and impact limited to availability. No known exploits in the wild have been reported, and no official fix or patch has been documented as of the published date.

Successful exploitation results in a denial of service due to application crash caused by heap-based buffer overflow in the Z39.50 dissector. There is no reported impact on confidentiality or integrity. The attack requires local access and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid processing untrusted Z39.50 protocol data with affected Wireshark versions. Monitor official Wireshark Foundation communications for updates on patches or mitigations.