Skip to main content

Wireshark EUVDEUVD-2026-88684

| CVE-2026-95389 HIGH
Heap-based Buffer Overflow (CWE-122)
2026-09-29 GitLab GHSA-7xm4-72f8-6hpw
Buffer Overflow Denial Of Service Heap Overflow Red Hat Wireshark Suse Wireshark Foundation
8.1
CVSS 3.1 · Vendor: GitLab
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Craft malformed SCTP packet
  2. Delivery
    Deliver via live capture or shared .pcap
  3. Exploit
    Wireshark SCTP dissector parses packet
  4. Execution
    Heap buffer overflow triggers crash
  5. Impact
    Analyst session denial of service

Vulnerability Assessment

Weakness
CWE
CWE-122
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK

1 technique across 1 tactic: Execution

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires Wireshark (versions 4.6.0-4.6.8 or 4.4.0-4.4.18) to process attacker-controlled SCTP traffic - either by live-capturing a crafted SCTP packet on a monitored interface or by opening a malicious capture file containing one. Exploitation is limited to the SCTP dissector code path, requires a specifically malformed packet (hence high attack complexity), and impacts only the analyst's Wireshark/tshark process (a client tool), not any server or the host system. The realistic effect is a crash/denial of service, not code execution per the vendor description.
Impact

The input CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1) is internally inconsistent with the vulnerability description, which states only 'SCTP protocol dissector crash ... allows denial of service.' A dissector crash affects availability of the Wireshark analysis process - it does NOT provide confidentiality or integrity impact, so the C:H/I:H rating is almost certainly overstated; the realistic impact is A only. Treat the vendor 8.1 as inflated for a DoS-only issue. No EPSS score, no CISA KEV listing, and no public exploit code are indicated in the input, so exploitation status is 'no public exploit identified at time of analysis.' AC:H is appropriate because a specifically malformed SCTP packet is needed to trigger the heap corruption. The practical risk is low-to-moderate: Wireshark is a client/analyst tool, not a server, so a crash disrupts a single analyst's session rather than production infrastructure. This is a high-CVSS-but-modest-real-risk issue; prioritize patching for SOC/IR teams who dissect untrusted captures, but it is not an emergency.
Exploit ScenarioDerived

An attacker crafts a malformed SCTP packet and either injects it onto a network segment being live-captured or delivers a malicious .pcap/.pcapng capture file to an analyst who opens it in Wireshark. When the SCTP dissector parses the packet it triggers a heap-based buffer overflow (CWE-122) and crashes, terminating the analysis session. No public exploit code is identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 29, 2026

Malformed SCTP traffic can crash the Wireshark/tshark dissector in versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18, turning a heap-based buffer overflow (CWE-122) in the SCTP dissector into a denial of service against the analyst's own capture session rather than against any remote service. Exploitation requires the tool to process an attacker-supplied packet - either live-captured on a monitored interface carrying crafted SCTP traffic or opened from a malicious capture file - and the packet must be specifically malformed, which is why the high attack-complexity rating applies. Access requirements are unauthenticated per the CVSS vector (PR:N), and the realistic outcome is a crash of the Wireshark/tshark process, not code execution or host compromise; no public exploit code and no confirmed active exploitation were identified at time of analysis. Note that the originally supplied CVSS vector claimed high confidentiality and integrity impact, which the independent assessment corrected to availability-only (C:N/I:N/A:H).

RemediationAI

Upgrade Wireshark to a release newer than 4.6.8 on the 4.6.x branch and newer than 4.4.18 on the 4.4.x branch; an exact fixed version is not stated in the available data, so confirm the patched release on the vendor advisory https://www.wireshark.org/security/wnpa-sec-2026-93.html and the upstream work item https://gitlab.com/wireshark/wireshark/-/work_items/21481 before relying on a specific build number. If immediate upgrade is not possible, disable SCTP dissection so the vulnerable code path is never reached (in the GUI, Edit > Preferences > Protocols > SCTP and clear 'Enable SCTP dissection', or use Analyze > Enabled Protocols to uncheck SCTP); the trade-off is loss of all SCTP analysis, which may be unacceptable for telecom/SIGTRAN troubleshooting. Additional compensating controls include avoiding live captures on untrusted or internet-facing SCTP traffic, opening capture files from untrusted sources only inside a disposable container or VM running tshark without capture privileges, and running Wireshark/dumpcap as a non-privileged user so a dissector crash cannot be escalated; none of these substitute for patching, since they only reduce exposure to the crash.

Affected VersionsENISA

Wireshark 4.4.0 <4.4.19
Wireshark 4.6.0 <4.6.9

Affected Packages

euvd wireshark fix: 4.4.19, 4.6.9

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Wireshark parses network protocols through modular dissectors, and the SCTP dissector handles the Stream Control Transmission Protocol (IP protocol 132), widely used in telecom signalling (SIGTRAN, SS7 over IP, Diameter, 5G core) and occasionally on general networks. The root cause class here is CWE-122, a heap-based buffer overflow, meaning the dissector mishandles a length or field value in a malformed SCTP packet and overflows a heap-allocated buffer while decoding. The CPE string cpe:2.3:a:wireshark_foundation:wireshark:*:*:*:*:*:*:*:* confirms the affected product is the Wireshark Foundation's Wireshark distribution as a whole rather than a separate plugin, and the code path applies equally to the GUI (Wireshark) and CLI (tshark) front ends that share these libraries. Because the tool is a client-side analysis application, the attack surface is the analyst's workstation: the packet must either arrive on an interface being captured or be embedded in a pcap/pcapng file the analyst opens. The initial CVSS 3.1 vector supplied (C:H/I:H/A:H, 8.1) is internally inconsistent with the vendor's "dissector crash" description; the authoritative assessment is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, i.e. an unauthenticated but high-complexity availability impact confined to the dissector process.

Know when Wireshark gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitLab) PRIMARY 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.9 MEDIUM

Dissector crash is DoS-only so C:N/I:N/A:H; AC:H for the crafted-packet requirement; AV:N/UI:N reflects live-capture path (file-open path would be UI:R).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 7.8 HIGH

Primary rating from Vendor (GitLab).

CVSS VectorVendor: GitLab

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Patch available
Sep 29, 2026 - 11:01 EUVD
CVE Published
Sep 29, 2026 - 09:33 cve.org
HIGH 8.1

DescriptionCVE.org

SCTP protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

Executive ViewAI

Why It Matters

Wireshark and tshark versions 4.6.0-4.6.8 and 4.4.0-4.4.18 contain a heap-based buffer overflow in the SCTP dissector that can crash the application when processing a malformed packet, disrupting security analysts' ability to capture and inspect network traffic. This denial-of-service condition affects only the local analysis session, not remote services or host integrity, but it could blind incident response teams during critical investigations; no public exploit has been identified at time of analysis. Leadership should prioritize patching once available and enforce safe handling of untrusted capture files to maintain operational visibility.

Business Impact: Medium
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: disable the SCTP dissector in Wireshark/tshark settings, avoid opening untrusted capture files or capturing live SCTP traffic, run analysis in isolated or sandboxed environments, and restrict permissions for capture tools. Monitor vendor advisories for patch availability.

Threat Intelligence Overview

EPSS Score
0.4%
Top 69% exploitable
Prevalence
High
Wireshark is the de facto standard network protocol analyzer, widely deployed
Data Quality
6 sources
Confidence: High
EUVD 🇯🇵JVN NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
Poc
System Exposure· derived
Open
Automatable
No
Human Impact
Medium
Technical Impact
Total

Priority Score

40
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Heap Overflow HIGH

A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Wireshark

View all
CVE-2014-2299 CRITICAL POC
9.3 Mar 11

Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10
CVE-2013-4074 MEDIUM POC
5.0 Jun 09

The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.
CVE-2018-6836 CRITICAL POC
9.8 Feb 08

The netmonrec_comment_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an un
CVE-2014-4174 CRITICAL POC
9.3 Jun 18

wiretap/libpcap.c in the libpcap file parser in Wireshark 1.10.x before 1.10.4 allows remote attackers to execute arbitr
CVE-2017-9353 HIGH POC
7.5 Jun 02

In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. Rated high severity (CVSS 7.5), this vulnerability is remot
CVE-2017-17085 HIGH POC
7.5 Dec 01

In Wireshark 2.4.0 to 2.4.2 and 2.2.0 to 2.2.10, the CIP Safety dissector could crash. Rated high severity (CVSS 7.5), t
CVE-2017-9347 HIGH POC
7.5 Jun 02

In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. Rated high severity (CVSS 7.
CVE-2025-5601 HIGH POC
7.8 Jun 04

A denial of service vulnerability in Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 (CVSS 7.8)

CVE-2023-4513 HIGH POC
7.5 Aug 24

BT SDP dissector memory leak in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injecti
CVE-2023-4512 HIGH POC
7.5 Aug 24

CBOR dissector crash in Wireshark 4.0.0 to 4.0.6 allows denial of service via packet injection or crafted capture file.

CVE-2023-2879 HIGH POC
7.5 May 26

GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or cra
CVE-2023-1992 HIGH POC
7.5 Apr 12

RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection o

Same weakness CWE-122 – Heap-based Buffer Overflow

View all
CVE-2023-4911 HIGH POC
7.8
CVE-2023-27997 CRITICAL
9.8
CVE-2026-94127 CRITICAL POC
9.3
CVE-2025-25249 CRITICAL POC
9.8
CVE-2026-85880 HIGH POC
7.8
CVE-2025-24985 HIGH POC
7.8
CVE-2026-53362 HIGH POC
7.8
CVE-2025-21418 HIGH
7.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-95389 ADVISORY https://vuldb.com/vuln/411259 REF https://gitlab.com/wireshark/wireshark/-/work_items/21481 REF https://www.wireshark.org/security/wnpa-sec-2026-93.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy