CVE-2023-6879

What it actually does

Heap overflow in av1_loop_restoration_dealloc() triggered when video frame resolution increases during multi-threaded AV1 encoding or analysis.

Why it matters to the business

Attackers could crash the application or execute arbitrary code by supplying specially crafted network captures, leading to loss of analysis capability, potential data exposure during packet inspection, and operational disruption for teams relying on traffic analysis.

How an attack unfolds

An attacker generates or modifies a packet capture containing AV1-encoded video traffic with increasing frame resolutions, then delivers the capture to a target system running the vulnerable version. When the target opens the file, multi-threaded processing in the AV1 restoration function overflows the heap, allowing control of execution flow.

How to fix it

Upgrade to Wireshark GIT commit 5ee0b97c963ed2e976ccd04c18f159fb3061c3a6 or later. Rebuild from source if using a development checkout and verify the commit is included before deployment.

How to confirm the fix worked

Confirm the installed Wireshark binary or source tree contains commit 5ee0b97c963ed2e976ccd04c18f159fb3061c3a6. Test by loading sample captures that previously triggered the overflow; the application should no longer crash or exhibit memory corruption.

Typical attack path

1. Craft malicious pcap with AV1 video frames that escalate resolution across threads
2. Deliver the capture file to the victim via email, download, or shared storage
3. Victim opens the file in the vulnerable Wireshark instance
4. Multi-threaded decode path calls av1_loop_restoration_dealloc() and overflows heap
5. Attacker gains code execution or causes denial of service

How to detect it

Review process crash logs and memory dumps for heap corruption patterns during Wireshark execution on packet captures. Correlate file-open events with subsequent abnormal termination or high-severity memory errors.

What your security team should do

• Immediately update all Wireshark instances to the fixed commit or a subsequent release containing it
• Restrict opening of untrusted packet captures until patches are applied
• Monitor for new Wireshark releases and integrate automated build verification of the fix commit
• Educate analysts on safe handling of external capture files