CVE-2026-96415 in Wireshark
Summary
by MITRE • 09/29/2026
Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified involves a critical flaw within the Catapult DCT2000 protocol dissector found in Wireshark versions ranging from 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8. This security issue manifests as an application crash, which constitutes a denial of service condition for users who process network traffic containing malformed or specifically crafted packets associated with the Catapult DCT2000 protocol. The dissector is responsible for parsing and displaying information about this specific industrial control system protocol within the Wireshark interface, allowing security professionals to inspect packet details during analysis. When the parser encounters unexpected data structures or boundary conditions that it fails to handle correctly, it triggers an unhandled exception leading to immediate termination of the application process.
From a technical perspective, this flaw represents a classic memory safety violation often categorized under CWE-125 Out-of-bounds Read or CWE-400 Uncontrolled Resource Consumption depending on the specific nature of the crash trigger such as buffer over-reads or infinite loops resulting from malformed input parsing logic. The root cause lies in insufficient validation of packet length fields or payload boundaries before accessing memory buffers allocated for dissecting the protocol data units. Attackers can exploit this weakness by constructing malicious network traffic that mimics legitimate Catapult DCT2000 frames but contains corrupted headers or payloads designed to exceed expected limits or trigger undefined behavior within the parsing routine. This exploitation does not require authentication and can be executed remotely if an attacker has access to the network segment where Wireshark is actively monitoring traffic.
The operational impact of this vulnerability centers on the disruption of security analysis workflows. Since Wireshark is a primary tool for deep packet inspection and forensic investigation, its sudden crash prevents analysts from continuing their work in real-time or analyzing captured pcap files containing such malicious payloads. In scenarios where automated systems rely on stable execution of network monitoring tools to detect anomalies, this denial of service can create blind spots allowing further attacks to proceed undetected. Furthermore, repeated crashes may lead users to disable specific protocol dissectors entirely, thereby reducing the visibility and effectiveness of security monitoring capabilities across industrial networks that utilize Catapult DCT2000 equipment for process control applications.
This vulnerability aligns with ATT&CK technique T1498 Network Denial of Service where an adversary disrupts availability by consuming resources or crashing services. It also relates to CWE-755 Improper Handling of Unexpected Data Type which highlights the failure of software to properly validate input data before processing it within critical parsing functions. The lack of robust error handling and boundary checks in older versions of the dissector underscores the importance of defensive programming practices when dealing with binary protocol specifications that may contain ambiguous or malformed structures from untrusted sources on industrial networks.
To mitigate this risk, organizations deploying Wireshark for network analysis must ensure they are running patched versions beyond 4.6.8 and 4.4.19 where these memory safety issues have been addressed by the development team. Immediate updates to the latest stable release of Wireshark are recommended to restore full functionality and resilience against crafted packet attacks. Additionally, administrators should consider implementing network segmentation strategies that limit exposure to untrusted traffic when running protocol dissectors in promiscuous mode. Regular patch management cycles for all security analysis tools within industrial control system environments are essential to maintain operational continuity and prevent adversaries from leveraging application instability as a vector for disrupting monitoring capabilities.