CVE-2026-95395: IEEE C37.118 Protocol DOS Vulnerability

CVE-2026-95395 Overview

CVE-2026-95395 is a memory leak vulnerability [CWE-401] in the Wireshark IEEE C37.118 Synchrophasor protocol dissector. The flaw affects Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. An attacker can trigger denial of service by causing Wireshark to process a crafted capture file or packet stream. Exploitation requires local user interaction, typically loading a malicious capture file. Successful exploitation exhausts memory and terminates the analysis session.

Critical Impact
Memory exhaustion in the Wireshark dissector causes application crash and loss of packet analysis capability, disrupting incident response and network forensics workflows.

Affected Products

Wireshark 4.6.0 through 4.6.8
Wireshark 4.4.0 through 4.4.18
IEEE C37.118 Synchrophasor protocol dissector component

Discovery Timeline

2026-09-29 - CVE-2026-95395 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-95395

Vulnerability Analysis

The vulnerability resides in the Wireshark IEEE C37.118 Synchrophasor protocol dissector. Synchrophasor is a protocol used in electrical grid monitoring to transmit phasor measurement unit (PMU) data. The dissector parses these frames to render human-readable output within Wireshark and TShark. The flaw is classified as a missing release of memory after effective lifetime [CWE-401].

When the dissector processes specific malformed or crafted Synchrophasor frames, allocated buffers are not released after use. Repeated processing of such frames accumulates unreleased memory. The process eventually exhausts available memory and terminates. Confidentiality and integrity are unaffected; the impact is limited to availability.

The attack path requires an analyst to open a crafted capture file or perform live capture on a network delivering malicious traffic. Because Wireshark is frequently used during incident response, disruption of the analysis workflow carries operational consequences.

Root Cause

The root cause is improper memory lifecycle management within the C37.118 dissector code. Buffers allocated during frame parsing are not freed on all code paths, particularly when malformed field lengths or truncated records are encountered. See the GitLab Wireshark Work Item for developer notes on the affected code path.

Attack Vector

An attacker crafts a .pcap or .pcapng file containing malformed IEEE C37.118 frames and delivers it to a Wireshark user. Alternatively, an attacker on the local network segment can generate malicious Synchrophasor traffic that Wireshark ingests during live capture. Processing the frames triggers the leak. User interaction is required and the attack complexity is low.

No working exploit is publicly available. Full technical details are published in the Wireshark Security Advisory WNPA-2026-96.

Detection Methods for CVE-2026-95395

Indicators of Compromise

Wireshark or TShark processes consuming abnormal amounts of resident memory during capture analysis
Repeated Wireshark crashes or forced termination when opening specific capture files
Presence of unexpected IEEE C37.118 (Synchrophasor) traffic on network segments where PMU devices are not deployed

Detection Strategies

Inventory endpoints running vulnerable Wireshark versions 4.6.0-4.6.8 and 4.4.0-4.4.18 using software asset management tooling
Monitor for capture file transfers to analyst workstations from untrusted sources such as email attachments and external file shares
Correlate Wireshark process termination events with recent capture file access using EDR telemetry

Monitoring Recommendations

Track memory consumption of wireshark.exe, tshark.exe, and dumpcap processes to detect abnormal growth patterns
Alert on Wireshark process crashes recorded in Windows Application event logs or Linux journald
Log capture file downloads and origin metadata for post-incident review

How to Mitigate CVE-2026-95395

Immediate Actions Required

Upgrade Wireshark to a fixed release as documented in the Wireshark Security Advisory WNPA-2026-96
Restrict opening of capture files sourced from untrusted parties until systems are patched
Disable the IEEE C37.118 Synchrophasor dissector on hosts that do not require it

Patch Information

The Wireshark project has published a fix through the tracking record at the GitLab Wireshark Work Item. Users should update to a version outside the affected 4.6.0-4.6.8 and 4.4.0-4.4.18 ranges. Confirm the installed build using wireshark --version or the Help menu after upgrading.

Workarounds

Disable the C37.118 dissector via Analyze > Enabled Protocols in the Wireshark GUI
Use tshark with --disable-protocol synphasor when processing capture files programmatically
Isolate capture analysis to dedicated forensic virtual machines with strict resource limits

bash

# Disable the vulnerable dissector from the command line
tshark --disable-protocol synphasor -r capture.pcapng

# Verify installed Wireshark version
wireshark --version | head -n 1