CVE-2026-96417: RF4CE Protocol Dissector DOS Vulnerability

CVE-2026-96417 Overview

CVE-2026-96417 is a heap-based buffer overflow [CWE-122] in the Wireshark Radio Frequency for Consumer Electronics (RF4CE) protocol dissector. The flaw affects Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. An attacker can crash the Wireshark process by supplying a malformed capture file or malicious packets processed by the dissector. Exploitation requires local access and user interaction, such as opening a crafted capture file. The vulnerability produces a denial of service condition without impacting confidentiality or integrity.

Critical Impact
A crafted RF4CE packet or capture file causes the Wireshark dissector to crash, terminating active analysis sessions and disrupting network forensic workflows.

Affected Products

Wireshark 4.6.0 through 4.6.8
Wireshark 4.4.0 through 4.4.18
Systems running Wireshark or tshark for RF4CE protocol analysis

Discovery Timeline

2026-09-29 - CVE-2026-96417 published to the National Vulnerability Database
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-96417

Vulnerability Analysis

The vulnerability resides in the RF4CE protocol dissector shipped with Wireshark. RF4CE is a low-power radio protocol used for consumer electronics remote control. When the dissector processes an RF4CE frame with unexpected field values or lengths, it writes beyond the bounds of a heap-allocated buffer. The out-of-bounds write corrupts adjacent heap memory and terminates the Wireshark process.

Because the attack vector is local and requires user interaction, exploitation typically occurs when an analyst opens a malicious .pcap or .pcapng file. Live captures on interfaces receiving crafted RF4CE traffic can also trigger the crash. The flaw affects only availability, producing repeated process termination rather than code execution in the tested conditions.

Root Cause

The root cause is improper bounds checking in the RF4CE dissector when parsing attacker-controlled length or offset fields. The dissector allocates a heap buffer sized from packet metadata, then writes into that buffer without validating that source data fits within the allocation. Refer to the Wireshark Security Advisory WNPA-2026-104 and the GitLab Wireshark Work Item for the specific code paths.

Attack Vector

An attacker delivers a crafted capture file to a target analyst or injects malformed RF4CE frames into a monitored network segment. When Wireshark loads the file or processes the live packets, the dissector executes the vulnerable parsing routine and crashes. No authentication is required, but the victim must open the file or actively capture the malicious traffic.

The vulnerability manifests during protocol dissection. See the linked security advisory for the specific parsing routine and patch details.

Detection Methods for CVE-2026-96417

Indicators of Compromise

Unexpected termination of wireshark or tshark processes shortly after opening a capture file
Crash dumps or core files referencing the RF4CE dissector module
Capture files received from untrusted sources containing RF4CE protocol frames

Detection Strategies

Monitor endpoint telemetry for repeated Wireshark process crashes correlated with capture file access
Inspect capture files in isolated analysis environments before opening them on production analyst workstations
Track installed Wireshark versions across the fleet and flag hosts running affected 4.4.x or 4.6.x releases

Monitoring Recommendations

Alert on Wireshark crash events logged in Windows Event Log, macOS unified logs, or Linux systemd-coredump
Log file open operations by wireshark.exe and tshark for capture files sourced from email or external media
Include Wireshark version data in software inventory dashboards to track patch compliance

How to Mitigate CVE-2026-96417

Immediate Actions Required

Upgrade Wireshark to a fixed release outside the affected 4.6.0–4.6.8 and 4.4.0–4.4.18 ranges
Restrict opening of capture files from untrusted sources until patching is complete
Analyze suspicious capture files in isolated virtual machines rather than on analyst workstations

Patch Information

The Wireshark Foundation has published fixes documented in Wireshark Security Advisory WNPA-2026-104. Users should upgrade to the latest patched release for their branch. Refer to the GitLab Wireshark Work Item for the underlying code change.

Workarounds

Disable the RF4CE dissector in Wireshark preferences under Analyze → Enabled Protocols if patching is not immediately possible
Use tshark with the --disable-protocol rf4ce flag when scripted processing of untrusted captures is required
Convert or filter capture files with a separate tool to strip RF4CE frames before opening in Wireshark

bash

# Disable the RF4CE dissector when processing untrusted captures
tshark --disable-protocol rf4ce -r suspicious.pcapng