Wireshark CVE-2026-95387

Exploitation requires the victim to process attacker-controlled SPDY protocol data in an affected Wireshark build - either by opening a crafted capture file (.pcap/.pcapng) or by live-capturing crafted SPDY traffic while the SPDY dissector is active. Limiting factors: user interaction is mandatory (CVSS UI:R - an analyst must open or load the malicious capture), only Wireshark GUI/tshark versions 4.6.0-4.6.8 and 4.4.0-4.4.18 are affected (patched in 4.6.9 and 4.4.19), and the impact is confined to crashing the Wireshark process rather than system compromise. There is no server-side or unattended exposure.

The signals conflict and, on balance, point to a LOWER real-world priority than the headline 8.8 suggests. The input CVSS:3.1 vector claims full confidentiality and integrity impact (C:H/I:H/A:H), but the description explicitly scopes this to a 'dissector crash' causing 'denial of service' - a Wireshark SPDY parser crash is an availability-only event, so the C:H/I:H components appear overstated and the true impact is DoS of the analysis tool. EPSS is low (0.45%, 37th percentile) and the vulnerability is NOT in CISA KEV, indicating no evidence of widespread or active exploitation. SSVC reinforces a measured posture: exploitation is only 'poc' (not active), Automatable is 'no' (user interaction required to open a crafted capture, consistent with UI:R), though Technical Impact is rated 'total' which again conflicts with the DoS-only description. A public PoC exists, but exploiting it merely crashes an analyst's Wireshark instance rather than compromising a server. Net: this is a genuine but modest-severity client-side DoS, not a high-urgency network-exploitable breach - the 8.8 is likely CVSS inflation and should be verified against the Wireshark advisory, which typically rates such dissector crashes far lower.

An attacker crafts a malicious packet capture (or live SPDY traffic) that triggers a heap buffer overflow in Wireshark's SPDY protocol dissector. When a security analyst opens the crafted .pcap/.pcapng file or captures the traffic in an affected Wireshark version, the dissector overflows the heap and crashes the application, denying the analyst use of the tool. A public proof-of-concept exists (SSVC exploitation status: poc).