CVE-2026-96416: IEEE 802.11 Protocol DOS Vulnerability

CVE-2026-96416 Overview

CVE-2026-96416 is a denial-of-service vulnerability in the Wireshark IEEE 802.11 protocol dissector. The flaw affects Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. Processing a crafted 802.11 capture triggers a crash in the dissector, terminating the analysis session. The weakness is categorized as a heap-based buffer overflow [CWE-122]. Exploitation requires local access and user interaction, such as opening a malicious capture file or feeding crafted traffic to a live capture. The vulnerability does not expose data confidentiality or integrity, but it disrupts availability for analysts relying on Wireshark for packet inspection.

Critical Impact
A crafted 802.11 frame causes the Wireshark dissector to crash, interrupting packet analysis workflows and potentially wasting captured session data.

Affected Products

Wireshark 4.6.0 through 4.6.8
Wireshark 4.4.0 through 4.4.18
IEEE 802.11 protocol dissector component

Discovery Timeline

2026-09-29 - CVE-2026-96416 published to the National Vulnerability Database
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-96416

Vulnerability Analysis

The vulnerability resides in the IEEE 802.11 dissector, the Wireshark component responsible for parsing wireless LAN frames. When the dissector processes specific fields inside a malformed 802.11 frame, it performs a heap operation that exceeds the allocated buffer boundary. The out-of-bounds write corrupts heap metadata and causes the Wireshark process to abort. Because the crash occurs in the dissector rather than the capture engine, the effect is limited to the analysis process rather than the underlying network stack.

Root Cause

The underlying weakness is a heap-based buffer overflow classified as [CWE-122]. The dissector fails to validate length or offset values embedded in attacker-controlled 802.11 fields before writing to a fixed-size heap buffer. This defect matches the pattern common to Wireshark dissector advisories, where insufficient bounds checks on protocol fields allow malformed inputs to reach unsafe memory operations. Refer to the Wireshark Security Advisory WNPA-SEC-2026-109 for maintainer details.

Attack Vector

An attacker must deliver a crafted 802.11 capture to a Wireshark user. Delivery paths include sending a malicious .pcap or .pcapng file, hosting the file on a shared repository, or transmitting crafted frames that a target captures live from a monitor-mode interface. Opening the file or activating the affected dissector triggers the crash. The vector is local and requires user interaction, which limits remote exploitation but does not eliminate the risk in incident response and threat hunting workflows.

No public proof-of-concept is available. For issue tracking, see the GitLab Work Item for Wireshark.

Detection Methods for CVE-2026-96416

Indicators of Compromise

Repeated unexpected termination of the Wireshark process (wireshark.exe or wireshark binary) shortly after loading a capture file.
Presence of untrusted .pcap or .pcapng files containing 802.11 frames delivered by email, chat, or file share.
Crash reports or core dumps referencing the packet-ieee80211 dissector module.

Detection Strategies

Inventory endpoints running Wireshark and compare installed versions against the affected ranges 4.6.0–4.6.8 and 4.4.0–4.4.18.
Alert on analyst workstations that open capture files sourced from external or untrusted origins.
Correlate Wireshark process crashes with recent file-open events to identify potential trigger files.

Monitoring Recommendations

Forward Windows Application event logs and Linux coredump telemetry to a central log store to detect Wireshark aborts.
Monitor endpoint file-download activity for 802.11 capture files arriving from external domains.
Track software inventory changes to confirm patched versions are deployed across analyst systems.

How to Mitigate CVE-2026-96416

Immediate Actions Required

Upgrade Wireshark to a fixed release outside the vulnerable ranges as identified in WNPA-SEC-2026-109.
Restrict opening of untrusted .pcap and .pcapng files, particularly those containing 802.11 traffic.
Isolate analysis workstations that process third-party captures from production networks.

Patch Information

The Wireshark Foundation addresses the defect in updates published alongside advisory WNPA-SEC-2026-109. Apply the vendor-supplied binary for your platform, or rebuild from the corrected source referenced in the GitLab Work Item for Wireshark. Verify version output with wireshark -v after installation.

Workarounds

Disable the IEEE 802.11 dissector in Wireshark preferences under Analyze → Enabled Protocols when patching is delayed.
Use tshark with the --disable-protocol wlan flag to bypass the vulnerable dissector during batch processing.
Perform capture analysis inside a disposable virtual machine to contain any process-level crash impact.

bash

# Disable the IEEE 802.11 dissector when running tshark
tshark -r suspicious_capture.pcapng --disable-protocol wlan

# Verify the installed Wireshark version
wireshark -v | head -n 1