CVE-2026-95389 in Wireshark
Summary
by MITRE • 09/29/2026
SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified involves a critical flaw within the Stream Control Transmission Protocol (SCTP) dissector, specifically affecting Wireshark versions ranging from 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8. This defect manifests as an application crash when processing malformed or specially crafted SCTP packets, thereby creating a direct pathway for denial of service attacks against network traffic analysis tools and potentially any software utilizing the underlying packet parsing libraries. The root cause lies in improper validation of input data during the dissection process, where the parser fails to adequately check buffer boundaries or handle unexpected protocol states before attempting memory access operations. This lack of rigorous boundary checking allows an attacker who can inject malicious SCTP traffic into a monitored network segment to trigger an exception that terminates the application process unexpectedly.
From a technical perspective, this issue is classified under CWE-125, which denotes Out-of-bounds Read, or potentially CWE-400 Uncontrolled Resource Consumption depending on the specific memory access pattern involved in the crash scenario. The vulnerability exploits the trust placed by the dissector in the structure of incoming SCTP chunks without sufficient verification of their integrity and length fields. When a packet contains malformed headers or payload data that exceeds expected limits, the parser attempts to read beyond allocated memory buffers or dereferences invalid pointers. This results in an access violation that causes the host application to crash immediately upon processing the malicious stream. The absence of robust error handling mechanisms means that rather than gracefully discarding the bad packet and continuing operation, the software fails catastrophically, disrupting ongoing network monitoring sessions and potentially causing data loss for any unsaved capture files currently open during the attack window.
The operational impact of this vulnerability is significant for security professionals and network administrators who rely on continuous traffic analysis. A successful exploitation allows a remote or local attacker to disrupt visibility into network communications by crashing the diagnostic tool. In environments where Wireshark or similar dissectors are used in automated monitoring systems, such crashes can lead to gaps in logging and detection capabilities, effectively blinding security operations centers during critical periods. Furthermore, if the dissector is integrated into larger applications that do not isolate parsing errors within sandboxed processes, the crash could propagate instability to dependent services. The simplicity of triggering this flaw makes it particularly dangerous as it requires minimal effort from an adversary who has access to inject SCTP traffic or manipulate network streams in real-time.
Mitigation strategies primarily involve upgrading to patched versions of Wireshark that address these parsing flaws by implementing stricter input validation and bounds checking within the SCTP dissector codebase. Organizations should immediately assess their inventory for affected version ranges and apply vendor-provided updates as soon as they become available. In scenarios where immediate patching is not feasible, network segmentation can be employed to restrict access to sensitive monitoring infrastructure from untrusted networks that might serve as attack vectors. Additionally, deploying intrusion detection systems capable of identifying malformed SCTP packets at the network perimeter provides an additional layer of defense by dropping malicious traffic before it reaches vulnerable endpoints. Regular auditing of packet capture workflows and ensuring that analysis tools are run with appropriate privilege levels can also help limit the blast radius should a crash occur due to other unforeseen vulnerabilities.