Wireshark CVE-2026-96416

Requires an analyst to open a crafted packet capture file, or to live-capture/dissect attacker-supplied traffic, containing a malformed IEEE 802.11 (Wi-Fi) frame while running Wireshark 4.6.0-4.6.8 or 4.4.0-4.4.18. Exploitation is LIMITED by: mandatory user interaction (UI:R) to load/dissect the data, local attack vector (AV:L - no remote network trigger against the tool itself), and availability-only impact (a recoverable crash, no confidentiality or integrity loss). The IEEE 802.11 dissector is enabled by default, so no special configuration is needed beyond processing the malicious 802.11 data.

This is a genuinely low-priority issue despite its Medium CVSS 5.5 score. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) makes the true nature clear: this is a LOCAL, availability-only crash requiring user interaction, not a network-exploitable RCE. Although CWE-122 (heap-based buffer overflow) can in principle lead to code execution, the vendor explicitly scoped impact to 'denial of service' / 'crash' and set C:N/I:N with A:H - meaning it is treated as a crash, not memory-corruption-to-code-exec. There is no EPSS score, no CISA KEV listing, and no public exploit identified. The 'Buffer Overflow' and 'Heap Overflow' tags overstate the practical impact relative to the availability-only vector. Wireshark is ubiquitous among network analysts, so the attack surface is broad, but the trigger is narrow (a user must actively load or dissect an attacker-supplied capture) and the outcome is a recoverable application crash. Net: real but low-severity - a classic 'file-parser DoS in an analyst tool' rather than an urgent priority.

An attacker crafts a malformed packet capture file (or injects a malformed IEEE 802.11 / Wi-Fi frame onto a monitored medium) and induces an analyst to open it in a vulnerable Wireshark build. When the 802.11 dissector parses the crafted frame, a heap overflow triggers a crash, terminating the analysis session. No public exploit code has been identified at time of analysis, and exploitation yields only a denial of service against the local application.