CVE-2026-0961: Wireshark BLF Parser DoS Vulnerability

CVE-2026-0961 Overview

CVE-2026-0961 is an out-of-bounds write vulnerability (CWE-787) affecting the BLF file parser in Wireshark, a widely-used network protocol analyzer. This vulnerability allows attackers to cause a denial of service condition by providing a specially crafted BLF (Binary Log File) file that triggers a crash in the parser component.

Critical Impact

Exploitation of this vulnerability can lead to application crashes and denial of service, potentially disrupting network analysis operations and security monitoring activities that rely on Wireshark.

Affected Products

• Wireshark versions 4.6.0 to 4.6.2
• Wireshark versions 4.4.0 to 4.4.12

Discovery Timeline

• 2026-01-14 - CVE-2026-0961 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2026-0961

Vulnerability Analysis

The vulnerability resides in the BLF file parser component of Wireshark. BLF (Binary Log File) is a file format commonly used for storing CAN (Controller Area Network) bus data, often used in automotive and industrial applications. When Wireshark attempts to parse a malformed BLF file, an out-of-bounds write condition occurs, leading to memory corruption and subsequent application crash.

The attack requires user interaction—specifically, a victim must open a malicious BLF file or apply it as a capture filter. This could occur through various social engineering scenarios, such as receiving a seemingly legitimate capture file for analysis. The vulnerability affects the application's availability without compromising confidentiality or integrity of data.

Root Cause

The root cause is an out-of-bounds write (CWE-787) in the BLF file parser. This type of vulnerability occurs when the software writes data past the boundaries of allocated memory buffers. In this case, insufficient bounds checking when processing BLF file structures allows malformed input to trigger memory writes outside intended buffer limits, corrupting memory and causing the application to crash.

Attack Vector

The attack vector is network-based, requiring user interaction. An attacker can exploit this vulnerability by:

1. Crafting a malicious BLF file with specially constructed data that triggers the out-of-bounds write
2. Distributing the malicious file to potential victims via email attachments, file sharing, or malicious websites
3. When the victim opens the file in Wireshark, the parser crashes, causing denial of service

The vulnerability mechanism involves malformed data structures within the BLF file format that bypass boundary validation. When parsed, these structures cause the application to write beyond allocated buffer limits.

For technical details on the specific crash condition, refer to the GitLab Wireshark Issue #20880 and the Wireshark Security Advisory WNPA-SEC-2026-01.

Detection Methods for CVE-2026-0961

Indicators of Compromise

• Unexpected Wireshark crashes when opening BLF files from untrusted sources
• Core dumps or crash reports indicating memory corruption in the BLF dissector component
• Presence of unusually structured or malformed .blf files in user download directories

Detection Strategies

• Monitor for Wireshark application crashes, particularly when associated with BLF file operations
• Implement file integrity monitoring to detect suspicious .blf files arriving from external sources
• Review endpoint telemetry for repeated crash events in wireshark or tshark processes

Monitoring Recommendations

• Enable application crash logging and forward Wireshark crash events to SIEM systems
• Implement email gateway scanning to quarantine suspicious BLF file attachments
• Monitor network shares and collaboration platforms for distribution of malformed capture files

How to Mitigate CVE-2026-0961

Immediate Actions Required

• Upgrade Wireshark to version 4.6.3 or later (for 4.6.x branch) or 4.4.13 or later (for 4.4.x branch)
• Avoid opening BLF files from untrusted or unknown sources until patched
• Consider temporarily disabling or removing the BLF file parser if not required for operations

Patch Information

Wireshark has released security updates addressing this vulnerability. Users should update to the latest stable release from the official Wireshark website or through their system package manager. Detailed patch information is available in the Wireshark Security Advisory WNPA-SEC-2026-01.

Workarounds

• Disable the BLF file type association to prevent accidental opening of malicious files
• Use file analysis tools to inspect BLF files before opening them in Wireshark
• Implement network security controls to block or quarantine BLF files at email gateways and web proxies

# Example: Update Wireshark on Debian/Ubuntu systems
sudo apt update
sudo apt install --only-upgrade wireshark

# Example: Update Wireshark on RHEL/CentOS systems
sudo dnf upgrade wireshark

# Verify installed version after update
wireshark --version