CVE-2026-96422 in Wireshark
Summary
by MITRE • 09/29/2026
Frame protocol metadissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified involves a critical flaw within the frame protocol metadissector, specifically affecting Wireshark versions ranging from 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. This issue manifests as an application crash when processing malformed or specially crafted network traffic that triggers a failure in the metadata extraction logic of the dissector. The root cause typically stems from improper validation of input data structures, leading to out-of-bounds memory access or null pointer dereference during the parsing phase. Such errors are characteristic of CWE-125 Out-of-Bounds Read and CWE-476 NULL Pointer Dereference, which represent fundamental software defects where the application fails to verify that accessed memory locations are valid before attempting to read from them.
From an operational perspective, this vulnerability enables a denial of service attack against users who analyze network captures containing maliciously constructed packets. An attacker positioned on the same network segment or capable of injecting traffic into a capture file can trigger the crash by sending specific frame protocol messages that exploit the metadissector's inability to handle edge cases in metadata fields. The impact is immediate and disruptive, as Wireshark terminates unexpectedly without saving unsaved work or providing diagnostic output, thereby interrupting forensic analysis, troubleshooting sessions, and security monitoring activities. This lack of resilience undermines the reliability of network analysis tools when faced with adversarial inputs designed to exploit parsing logic errors.
The technical execution relies on the dissector's assumption that certain metadata fields will always conform to expected formats or lengths. When a packet contains truncated headers, unexpected data types, or malformed length indicators within the frame protocol structure, the metadissector attempts to process these anomalies without adequate bounds checking. This leads to memory corruption or an immediate segmentation fault depending on the specific version and platform architecture. The vulnerability highlights the risks associated with complex parsing engines that must handle a wide variety of packet formats while maintaining stability under adversarial conditions. It underscores the necessity for robust error handling mechanisms in network protocol analyzers to prevent local crashes from being triggered by remote inputs.
Mitigation strategies primarily involve upgrading Wireshark to versions beyond 4.6.8 and 4.4.18, where these parsing flaws have been addressed through improved input validation and memory safety checks. For environments unable to upgrade immediately, operators should restrict the use of untrusted capture files or disable specific dissectors that are known to be vulnerable if such configuration options exist in their deployment context. Additionally, implementing network segmentation can limit exposure by preventing unauthorized users from injecting crafted packets into monitored segments where Wireshark is actively running. Security teams should also consider integrating automated fuzzing tools during development cycles to identify similar parsing vulnerabilities before they reach production releases.
This incident aligns with ATT&CK technique T1498 Network Denial of Service, specifically the variant involving resource exhaustion or application crash via malformed inputs. It serves as a reminder that even trusted analysis software can become an attack vector if not hardened against maliciously crafted data streams. The resolution emphasizes the importance of secure coding practices in network protocol implementations, particularly regarding memory management and input sanitization. By addressing these flaws, developers ensure that critical infrastructure monitoring tools remain available and reliable during security incidents or routine operations involving potentially hostile traffic patterns.