CVE-2026-95392 in Wireshark
Summary
by MITRE • 09/29/2026
MBIM protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The Mobile Broadband Interface Model, commonly known as MBIM, is a standard interface specification used by cellular modems for communication with host devices over USB or other transport mechanisms. Wireshark serves as the de facto industry-standard network protocol analyzer and relies on dissectors to parse raw packet data into human-readable formats for each supported protocol. A critical vulnerability exists within the MBIM dissector in specific versions of Wireshark, namely version ranges 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. This flaw manifests as a crash condition triggered by malformed or specially crafted network traffic that utilizes the MBIM protocol structure. The vulnerability stems from improper validation of input data within the parsing logic, leading to an out-of-bounds memory access or null pointer dereference when processing unexpected field values in the MBIM message headers or payload structures.
From a technical perspective, this issue represents a classic denial of service vector arising from insufficient boundary checks during protocol decoding. When Wireshark processes traffic captured from a network interface or loaded from a capture file containing maliciously constructed MBIM packets, the dissector fails to verify that data lengths and offsets are within acceptable limits before accessing memory buffers. This lack of sanitization allows an attacker who can inject such traffic into the monitored segment, or craft a specific pcap file for analysis, to cause the application to terminate unexpectedly. The crash typically results in the loss of all open capture files and unsaved work, effectively disrupting any ongoing network monitoring activities that depend on Wireshark for real-time inspection or post-capture forensic analysis.
The operational impact of this vulnerability is primarily focused on availability rather than confidentiality or integrity. For security professionals relying on Wireshark to monitor cellular modem traffic, diagnose connectivity issues, or analyze protocol compliance in IoT and mobile broadband environments, a crash renders the tool unusable until it is restarted. In scenarios where continuous monitoring is required for incident response or threat hunting, this interruption can create blind spots during critical investigation phases. Furthermore, if an attacker has access to the network segment containing MBIM-enabled devices, they could potentially use repeated injection of malformed packets to cause persistent instability in the analyst's workstation, thereby hindering security operations without needing to compromise the underlying cellular infrastructure itself.
This vulnerability aligns with Common Weakness Enumeration category CWE-125, which describes Out-of-bounds Read, as well as CWE-400 concerning Uncontrolled Resource Consumption if the crash leads to resource leaks or repeated restart cycles. In terms of the MITRE ATT&CK framework, this exploit technique falls under T1499 Endpoint Denial of Service, specifically leveraging application layer vulnerabilities to disrupt host-based security tools. The attack vector is classified as Network-Based for live traffic injection and Local File Access if triggered via a crafted capture file opened by the user.
To mitigate this risk, organizations utilizing Wireshark must immediately upgrade to patched versions outside the affected ranges, ensuring that version 4.6.9 or later in the 4.6 branch, or version 4.4.19 and above in the 4.4 maintenance line is deployed across all analyst workstations. Until upgrades are feasible, analysts should exercise extreme caution when opening capture files from untrusted sources or monitoring traffic on segments with potentially compromised cellular modems. Implementing network segmentation to isolate MBIM-enabled devices from general workstation networks can also reduce exposure. Additionally, enabling strict input validation policies for any custom dissectors developed in-house and adhering to secure coding practices that prioritize bounds checking are essential long-term strategies to prevent similar memory safety vulnerabilities in protocol analysis tools.