CVE-2026-96421 in Wireshark
Summary
by MITRE • 09/29/2026
USB HID protocol dissector infinite loop and memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified involves a critical flaw within the USB Human Interface Device (HID) protocol dissector, specifically affecting Wireshark versions ranging from 4.4.0 through 4.4.18 and 4.6.0 through 4.6.8. This security issue manifests as an infinite loop coupled with a memory leak when processing malformed or specially crafted USB HID reports. The root cause lies in the logic used to parse descriptor data, where certain edge cases fail to properly terminate iteration loops over report fields. When a packet containing such anomalous descriptors is analyzed by the dissector, the software enters a state of continuous execution without progressing to subsequent packets or completing the analysis task. This behavior directly leads to excessive consumption of central processing unit resources and unbounded allocation of memory as the application attempts to process the non-terminating loop structure.
From an operational perspective, this vulnerability poses a significant risk for denial of service against network analysts and security professionals who utilize Wireshark for traffic capture and inspection. An attacker capable of injecting malicious USB HID packets into a monitored environment or providing a crafted pcap file can trigger this condition remotely if the user opens the file within the affected versions of the software. The infinite loop causes the application to become unresponsive, effectively freezing the interface and preventing any further interaction with the tool. Simultaneously, the associated memory leak gradually consumes available system RAM, which may lead to system-wide instability or crash on systems with limited resources. This impacts the availability of critical network monitoring tools used in incident response and threat hunting operations.
The technical classification of this flaw aligns closely with CWE-835, which denotes a loop that does not terminate, often resulting from incorrect boundary conditions or missing exit criteria in parsing logic. Additionally, because it allows an attacker to disrupt the availability of a service through resource exhaustion via crafted input, it falls under the ATT&CK technique T1499, specifically Endpoint Denial of Service. The vulnerability highlights the importance of robust input validation and state management within protocol dissectors that handle complex binary structures like USB descriptors. Developers must ensure that all iterative processes have strict limits or valid termination conditions based on descriptor length fields rather than relying solely on structural assumptions about well-formed data.
Mitigation strategies primarily involve upgrading to a patched version of Wireshark where the parsing logic has been corrected to properly handle malformed HID reports and prevent infinite iteration. Users should avoid opening untrusted pcap files containing USB traffic until they have verified their software is up to date with the latest security patches released by the maintainers. In environments where immediate patching is not feasible, restricting access to network capture tools or implementing strict filtering rules at the packet collection layer can reduce exposure to crafted malicious payloads designed to exploit this specific dissector flaw. Regular auditing of third-party tool dependencies and adherence to secure coding practices for binary protocol parsers are essential steps in preventing similar vulnerabilities in future software releases.