CVE-2026-0961: Wireshark BLF Parser DoS Vulnerability

CVE-2026-0961 Overview

CVE-2026-0961 is an out-of-bounds write vulnerability (CWE-787) affecting the BLF file parser in Wireshark, a widely-used network protocol analyzer. This vulnerability allows attackers to cause a denial of service condition by providing a specially crafted BLF (Binary Log File) file that triggers a crash in the parser component.

Critical Impact
Exploitation of this vulnerability can lead to application crashes and denial of service, potentially disrupting network analysis operations and security monitoring activities that rely on Wireshark.

Affected Products

Wireshark versions 4.6.0 to 4.6.2
Wireshark versions 4.4.0 to 4.4.12

Discovery Timeline

2026-01-14 - CVE-2026-0961 published to NVD
2026-01-21 - Last updated in NVD database

Technical Details for CVE-2026-0961

Vulnerability Analysis

The vulnerability resides in the BLF file parser component of Wireshark. BLF (Binary Log File) is a file format commonly used for storing CAN (Controller Area Network) bus data, often used in automotive and industrial applications. When Wireshark attempts to parse a malformed BLF file, an out-of-bounds write condition occurs, leading to memory corruption and subsequent application crash.

The attack requires user interaction—specifically, a victim must open a malicious BLF file or apply it as a capture filter. This could occur through various social engineering scenarios, such as receiving a seemingly legitimate capture file for analysis. The vulnerability affects the application's availability without compromising confidentiality or integrity of data.

Root Cause

The root cause is an out-of-bounds write (CWE-787) in the BLF file parser. This type of vulnerability occurs when the software writes data past the boundaries of allocated memory buffers. In this case, insufficient bounds checking when processing BLF file structures allows malformed input to trigger memory writes outside intended buffer limits, corrupting memory and causing the application to crash.

Attack Vector

The attack vector is network-based, requiring user interaction. An attacker can exploit this vulnerability by:

Crafting a malicious BLF file with specially constructed data that triggers the out-of-bounds write
Distributing the malicious file to potential victims via email attachments, file sharing, or malicious websites
When the victim opens the file in Wireshark, the parser crashes, causing denial of service

The vulnerability mechanism involves malformed data structures within the BLF file format that bypass boundary validation. When parsed, these structures cause the application to write beyond allocated buffer limits.

For technical details on the specific crash condition, refer to the GitLab Wireshark Issue #20880 and the Wireshark Security Advisory WNPA-SEC-2026-01.

Detection Methods for CVE-2026-0961

Indicators of Compromise

Unexpected Wireshark crashes when opening BLF files from untrusted sources
Core dumps or crash reports indicating memory corruption in the BLF dissector component
Presence of unusually structured or malformed .blf files in user download directories

Detection Strategies

Monitor for Wireshark application crashes, particularly when associated with BLF file operations
Implement file integrity monitoring to detect suspicious .blf files arriving from external sources
Review endpoint telemetry for repeated crash events in wireshark or tshark processes

Monitoring Recommendations

Enable application crash logging and forward Wireshark crash events to SIEM systems
Implement email gateway scanning to quarantine suspicious BLF file attachments
Monitor network shares and collaboration platforms for distribution of malformed capture files

How to Mitigate CVE-2026-0961

Immediate Actions Required

Upgrade Wireshark to version 4.6.3 or later (for 4.6.x branch) or 4.4.13 or later (for 4.4.x branch)
Avoid opening BLF files from untrusted or unknown sources until patched
Consider temporarily disabling or removing the BLF file parser if not required for operations

Patch Information

Wireshark has released security updates addressing this vulnerability. Users should update to the latest stable release from the official Wireshark website or through their system package manager. Detailed patch information is available in the Wireshark Security Advisory WNPA-SEC-2026-01.

Workarounds

Disable the BLF file type association to prevent accidental opening of malicious files
Use file analysis tools to inspect BLF files before opening them in Wireshark
Implement network security controls to block or quarantine BLF files at email gateways and web proxies

bash

# Example: Update Wireshark on Debian/Ubuntu systems
sudo apt update
sudo apt install --only-upgrade wireshark

# Example: Update Wireshark on RHEL/CentOS systems
sudo dnf upgrade wireshark

# Verify installed version after update
wireshark --version