CVE-2026-3201: Wireshark USB HID DOS Vulnerability

CVE-2026-3201 Overview

CVE-2026-3201 is a memory exhaustion vulnerability in Wireshark's USB HID protocol dissector that enables denial of service attacks. When parsing specially crafted USB HID protocol traffic, the dissector fails to properly constrain memory allocation, allowing an attacker to exhaust system memory and crash Wireshark or the entire host system.

Critical Impact

Attackers can remotely trigger denial of service by sending malicious network traffic to a system running vulnerable Wireshark versions, causing memory exhaustion and application crash.

Affected Products

• Wireshark versions 4.6.0 to 4.6.3
• Wireshark versions 4.4.0 to 4.4.13

Discovery Timeline

• 2026-02-25 - CVE CVE-2026-3201 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-3201

Vulnerability Analysis

This vulnerability resides in Wireshark's USB HID (Human Interface Device) protocol dissector, which is responsible for parsing and analyzing USB HID traffic captured during network analysis sessions. The flaw is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-1325 (Improperly Controlled Sequential Memory Allocation), indicating a fundamental issue in how the dissector manages memory during packet processing.

The vulnerability allows an attacker to cause uncontrolled memory consumption by crafting malicious USB HID protocol data. When Wireshark attempts to dissect this traffic, the USB HID dissector allocates memory without proper bounds checking, leading to progressive memory exhaustion. This can render the application unresponsive and potentially crash the entire system if memory pressure becomes severe enough.

The attack can be executed remotely via network capture files (such as malicious .pcap or .pcapng files) or by injecting crafted packets into monitored network traffic.

Root Cause

The root cause stems from improper resource allocation controls within the USB HID protocol dissector. The dissector lacks adequate limits on memory allocation when processing USB HID descriptor fields and report data structures. This allows specially crafted packets to trigger unbounded sequential memory allocations, bypassing the normal memory management constraints that should prevent resource exhaustion.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction required. An attacker can deliver the malicious payload through several vectors:

1. Malicious capture files: Distributing a crafted .pcap or .pcapng file that triggers the vulnerability when opened in Wireshark
2. Live traffic injection: Injecting malicious USB HID protocol packets into a network being actively monitored by a vulnerable Wireshark instance
3. Remote capture sessions: Exploiting Wireshark instances performing remote packet capture

The exploitation mechanism involves sending USB HID protocol data with malformed structures that cause the dissector to allocate excessive memory during parsing operations. This results in denial of service through memory exhaustion.

For technical details on the vulnerability mechanism, see the GitLab Wireshark Issue #20972 and the Wireshark Security Advisory WNPA-SEC-2026-05.

Detection Methods for CVE-2026-3201

Indicators of Compromise

• Unusual memory consumption spikes when Wireshark processes USB HID protocol traffic
• Wireshark process crashes or hangs during packet capture or file analysis sessions
• System memory warnings or out-of-memory errors coinciding with Wireshark usage
• Presence of unusually large or malformed USB HID packets in capture files

Detection Strategies

• Monitor Wireshark process memory usage for abnormal growth patterns during active capture sessions
• Implement file integrity checks on capture files before opening in Wireshark
• Use resource monitoring tools to detect sudden memory allocation increases in the wireshark or tshark processes
• Deploy network segmentation to limit exposure of systems running vulnerable Wireshark versions

Monitoring Recommendations

• Configure system alerts for memory threshold violations on workstations running Wireshark
• Implement logging and auditing for Wireshark usage in enterprise environments
• Monitor for unexpected Wireshark process terminations or restarts
• Track versions of Wireshark deployed across the organization to identify vulnerable installations

How to Mitigate CVE-2026-3201

Immediate Actions Required

• Upgrade Wireshark to a patched version beyond 4.6.3 or 4.4.13 as applicable
• Avoid opening capture files from untrusted sources until patching is complete
• Consider disabling the USB HID protocol dissector if not required for analysis tasks
• Restrict network access to systems running Wireshark to trusted networks only

Patch Information

Wireshark has released security updates to address this vulnerability. Organizations should consult the Wireshark Security Advisory WNPA-SEC-2026-05 for official patch information and upgrade instructions.

Users of Wireshark 4.6.x should upgrade to a version newer than 4.6.3, while users of Wireshark 4.4.x should upgrade to a version newer than 4.4.13.

Workarounds

• Disable the USB HID protocol dissector via Wireshark preferences: Navigate to Analyze > Enabled Protocols and disable the USB HID dissector
• Use command-line filtering to exclude USB HID traffic from analysis when processing untrusted captures
• Run Wireshark in a sandboxed or containerized environment with memory limits to contain potential resource exhaustion
• Implement resource limits on Wireshark processes using operating system controls (e.g., ulimit on Linux)

# Configuration example - Disable USB HID dissector via command line
tshark -o "usb-hid.enabled:FALSE" -r suspicious_capture.pcapng

# Apply memory limits when running tshark (Linux)
ulimit -v 4194304  # Limit virtual memory to 4GB
tshark -r capture_file.pcapng