Skip to main content

Wireshark CVE-2026-96423

| EUVDEUVD-2026-88714 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-09-29 GitLab GHSA-969r-pwxc-fjq2
Buffer Overflow Denial Of Service Heap Overflow Wireshark Wireshark Foundation
7.1
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Deliver crafted capture file to analyst
  2. Exploit
    Analyst opens file in vulnerable Wireshark
  3. Execution
    X11 dissector triggers heap buffer overflow
  4. Impact
    Wireshark process crashes (denial of service)

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires an analyst to load or dissect attacker-supplied data in a vulnerable Wireshark (4.6.0-4.6.8 or 4.4.0-4.4.18) such that the X11 protocol dissector processes a malformed X11 message - e.g., opening a crafted capture (pcap/pcapng) file or dissecting crafted live X11 traffic. Limiting factors: the CVSS vector is local (AV:L) and requires user interaction (UI:R), there is no authentication to bypass but also no remote service exposure, and impact is confined to crashing the Wireshark process (availability of the analysis tool), not the host or network. The fix is to upgrade to 4.6.9 or 4.4.19.
Impact

Signals converge on LOW real-world priority despite the 7.1 'High' CVSS base score. The provided CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates a local attack requiring user interaction - the analyst must open or process a malicious capture, not a remotely reachable service. EPSS is very low (0.13%, 2nd percentile), there is no CISA KEV listing (not actively exploited), and CISA SSVC rates this Exploitation=poc, Automatable=no, Technical Impact=partial - all pointing to a non-urgent, non-wormable issue. The only aggravating signal is that exploit/POC code is referenced via the Wireshark GitLab work item. CONFLICT TO VERIFY: the input CVSS vector sets C:H (high confidentiality impact) and A:H, yet the description and CWE-122 (heap buffer overflow) describe a crash / denial of service only, with no information disclosure claimed. The C:H component appears inconsistent with a DoS-only dissector crash and inflates the 7.1 score; treat confidentiality impact as unconfirmed and verify against the Wireshark advisory (wnpa-sec-2026-108). Net: a genuine but low-severity, locally-triggered availability bug, not an emergency.
Exploit ScenarioDerived

An attacker crafts a malicious packet capture file (or crafted X11 protocol traffic) and lures an analyst into opening or dissecting it in a vulnerable Wireshark build, triggering a heap buffer overflow in the X11 protocol dissector that crashes the application. Publicly referenced exploit/reproduction material exists via the Wireshark GitLab work item, but exploitation is local and requires the victim to load the malicious input (CVSS UI:R), so there is no automated or remote-service attack path.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Oct 06, 2026

Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows a malformed X11 protocol message to crash the application via a heap-based buffer overflow in the X11 dissector. Exploitation requires a user to load a crafted capture file or dissect attacker-supplied live X11 traffic, giving a local, user-interaction-dependent vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) that, per the assessed vector, degrades only availability with no confidentiality or integrity impact - despite the vendor's 7.1 base score, which rated confidentiality high. Publicly available exploit code exists and CISA's SSVC rates the issue as proof-of-concept exploitation, not automatable, with partial technical impact; active exploitation is not indicated, and EPSS is only 0.13% (2nd percentile), so real-world risk is low. A vendor fix is available in 4.6.9 and 4.4.19.

Earlier versions of this analysis (1)
v1 Sep 29, 2026 - 10:08 CVSS 5.5

Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows a local attacker to crash the X11 protocol dissector by convincing a user to open a crafted capture file containing malformed X11 data (CWE-122, heap-based buffer overflow). The CVSS v3.1 score is 5.5 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), reflecting that exploitation requires user interaction and local delivery of the capture, yields only a process crash, and grants no code execution or data access; there is no public exploit identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV).

RemediationAI

Vendor-released patch: upgrade to Wireshark 4.6.9 (for the 4.6.x branch) or 4.4.19 (for the 4.4.x branch), as documented in wnpa-sec-2026-108 (https://www.wireshark.org/security/wnpa-sec-2026-108.html) and the GitLab work item 21563 (https://gitlab.com/wireshark/wireshark/-/work_items/21563); there is no need for interim mitigation once a fixed build is installed. If upgrading cannot be done immediately, the practical compensating control is to avoid dissecting untrusted or third-party-supplied X11 traffic: do not open untrusted pcap/pcapng files of unknown provenance (the trigger is user interaction, so analyst discipline directly removes exposure), or disable the X11 dissector for untrusted captures by setting it to "Disabled" in Analyze > Enabled Protocols or by using the "-o x11.enable:FALSE" preference at startup - accepting the trade-off that X11 traffic is then shown as undecoded data rather than parsed fields. Running Wireshark as a non-privileged user and keeping live capture privileges separate (dumpcap) limits any secondary effect of the crash, and where the crash occurs during live dissection the X11 capture filter can be scoped to trusted hosts only, at the cost of losing visibility into other X11 endpoints. Note that the assessed impact is availability of the analysis tool only; no host or network compromise follows from this bug.

Affected VersionsENISA

Wireshark 4.6.0 <4.6.9
Wireshark 4.4.0 <4.4.19

Affected Packages

euvd wireshark fix: 4.4.19, 4.6.9

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Wireshark is a widely deployed network protocol analyzer whose dissection engine parses packet payloads through per-protocol dissector modules; the X11 dissector handles the X Window System's client/server wire protocol, including length-prefixed request, reply, event and error messages. CWE-122 (heap-based buffer overflow) indicates that a crafted X11 message causes the dissector to write or copy past the bounds of a heap-allocated buffer, corrupting memory and terminating the Wireshark process. Because the flaw lives in the dissector rather than in a network service, there is no listening endpoint to attack remotely: the trigger is data the analyst opens or captures, matching the assessed AV:L/UI:R vector with PR:N and an availability-only impact (C:N/I:N/A:H). CISA's SSVC data characterizes the issue as proof-of-concept-driven, not automatable, and of partial technical impact, consistent with a crash confined to the analysis tool rather than host or network compromise. The affected CPE cpe:2.3:a:wireshark_foundation:wireshark:*:*:*:*:*:*:*:*:* covers the Wireshark Foundation product line, and ENISA's EUVD record (EUVD-2026-88714) confirms the two affected release branches.

Know when Wireshark gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitLab) PRIMARY MEDIUM
NVD 7.1 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
vuln.today AI 5.5 MEDIUM

User must open a crafted capture (AV:L, UI:R); CWE-122 crash yields availability loss only (A:H), so C:N/I:N - diverging from the input vector's unsupported C:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (GitLab).

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

4
Severity Changed
Oct 06, 2026 - 14:52 NVD
MEDIUM HIGH
CVSS changed
Oct 06, 2026 - 14:52 NVD
5.5 (MEDIUM) 7.1 (HIGH)
Patch available
Sep 29, 2026 - 11:01 EUVD
CVE Published
Sep 29, 2026 - 09:30 cve.org
MEDIUM 5.5

DescriptionNVD

X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

Executive ViewAI

Why It Matters

Wireshark, a widely used network protocol analyzer, contains a denial-of-service vulnerability that can crash the application during packet analysis, temporarily disrupting visibility for security operations and network engineering teams. Publicly available exploit code exists, but no active exploitation is indicated and the EPSS score is very low, so the primary business risk is temporary loss of analyst productivity rather than data compromise. A vendor patch (4.6.9 and 4.4.19) is available, making this a straightforward patch-management priority.

Business Impact: Low
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.1%
Top 98% exploitable
Prevalence
High
Wireshark is the de facto network analyzer across most IT/security teams
Data Quality
7 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.1%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Defer
Exploitation
Poc
System Exposure· derived
Small
Automatable
No
Human Impact
Low
Technical Impact
Partial

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Wireshark

View all
CVE-2014-2299 CRITICAL POC
9.3 Mar 11

Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10
CVE-2013-4074 MEDIUM POC
5.0 Jun 09

The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.
CVE-2018-6836 CRITICAL POC
9.8 Feb 08

The netmonrec_comment_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an un
CVE-2014-4174 CRITICAL POC
9.3 Jun 18

wiretap/libpcap.c in the libpcap file parser in Wireshark 1.10.x before 1.10.4 allows remote attackers to execute arbitr
CVE-2017-9353 HIGH POC
7.5 Jun 02

In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. Rated high severity (CVSS 7.5), this vulnerability is remot
CVE-2017-17085 HIGH POC
7.5 Dec 01

In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. Rated high severity (CVSS 7.5), t
CVE-2017-9347 HIGH POC
7.5 Jun 02

In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. Rated high severity (CVSS 7.
CVE-2025-5601 HIGH POC
7.8 Jun 04

A denial of service vulnerability in Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 (CVSS 7.8)

CVE-2023-4513 HIGH POC
7.5 Aug 24

BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injecti
CVE-2023-4512 HIGH POC
7.5 Aug 24

CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file.

CVE-2023-2879 HIGH POC
7.5 May 26

GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or cra
CVE-2023-1992 HIGH POC
7.5 Apr 12

RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection o

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-96423 ADVISORY https://vuldb.com/vuln/411282 REF https://gitlab.com/wireshark/wireshark/-/work_items/21563 REF https://www.wireshark.org/security/wnpa-sec-2026-108.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy