CVE-2026-95393 in Wireshark
Summary
by MITRE • 09/29/2026
CSN.1 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The CSN.1 protocol dissector, a component responsible for decoding Common Short Message Transfer Protocol version 1 messages within network analysis tools such as Wireshark, contains a critical memory safety vulnerability that affects versions ranging from 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18. This flaw manifests when the dissector processes malformed or specially crafted CSN.1 data streams, leading to an out-of-bounds read operation during the parsing of specific protocol fields. The vulnerability stems from insufficient validation of input boundaries before accessing memory structures associated with message elements, allowing a malicious actor who can inject arbitrary network traffic into the monitored segment to trigger this condition. When the dissector attempts to interpret these invalid sequences, it accesses memory locations outside the allocated buffer limits, which typically results in an immediate application crash or segmentation fault on most operating systems and architectures.
From a technical perspective, this issue is classified under CWE-125, Out-of-bounds Read, as the root cause involves reading data beyond the intended boundaries of a memory region. The operational impact is primarily characterized by a denial of service against the network analysis application itself rather than the underlying system or target devices being monitored. An attacker positioned on the same local area network can craft packets containing malformed CSN.1 headers that exploit this parsing logic error, causing the dissector to terminate unexpectedly every time such traffic is captured and displayed. This disrupts continuous monitoring capabilities, potentially obscuring other malicious activities occurring simultaneously within the network environment due to the loss of visibility provided by the crashed tool.
The vulnerability aligns with MITRE ATT&CK technique T1498, Network Denial of Service, specifically under sub-techniques involving resource exhaustion or application crashes through malformed inputs. While it does not allow for remote code execution or privilege escalation directly, its presence undermines the integrity and availability of security monitoring infrastructure. Organizations relying on these versions of network analysis software for real-time threat detection must recognize that even simple packet injection attacks can degrade their situational awareness by disabling critical diagnostic tools. The impact is particularly severe in environments where continuous protocol inspection is required for compliance or incident response workflows, as repeated crashes may lead to gaps in logging and forensic data collection during active attack scenarios.
Mitigation strategies require immediate upgrading of the network analysis software to a patched version outside the affected ranges, specifically versions 4.6.9 or later and 4.4.19 or later, where developers have implemented stricter boundary checks and input validation routines within the CSN.1 dissector logic. In scenarios where an upgrade is not immediately feasible, administrators should consider deploying network access controls to restrict which hosts can send traffic on protocols utilizing CSN.1 encoding, thereby limiting exposure to potential exploitation vectors. Additionally, enabling deep packet inspection at the firewall level with strict protocol validation rules can help filter out malformed packets before they reach the analysis endpoint, providing a compensating control that reduces the attack surface without requiring immediate software modification.