CVE-2026-96422: Wireshark Frame Protocol DoS Vulnerability

CVE-2026-96422 Overview

CVE-2026-96422 is a denial of service vulnerability in the Wireshark network protocol analyzer. The flaw resides in the Frame protocol metadissector and affects versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. An attacker can trigger a reachable assertion or unhandled condition [CWE-617] that crashes the Wireshark process. Exploitation requires a local attack vector and user interaction, typically opening a crafted capture file or feeding a malformed packet stream into a live dissection session. The bug does not expose data confidentiality or integrity, but it disrupts analyst workflows and can interrupt long-running captures.

Critical Impact
A crafted capture file or packet stream crashes the Wireshark Frame metadissector, halting analysis sessions on affected 4.6.x and 4.4.x builds.

Affected Products

Wireshark 4.6.0 through 4.6.8
Wireshark 4.4.0 through 4.4.18
Deployments that invoke tshark or dumpcap against untrusted capture input

Discovery Timeline

2026-09-29 - CVE-2026-96422 published to the National Vulnerability Database
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-96422

Vulnerability Analysis

Wireshark parses every captured frame through a metadissector that decodes link-layer metadata before handing the payload to protocol-specific dissectors. CVE-2026-96422 is a reachable assertion in that Frame metadissector path. Malformed metadata drives the dissector into an unexpected state and terminates the process. The result is a denial of service against the analyst workstation or any automated pipeline that dissects packets with the affected libraries.

The issue is classified under CWE-617: Reachable Assertion. Because dissection happens as soon as a capture is opened or a live capture receives a matching packet, the crash occurs without any additional user action beyond loading the input.

Root Cause

The defect stems from insufficient validation of frame metadata before it reaches an assertion in the Frame dissector. When the assertion condition fails, the process aborts instead of gracefully skipping the malformed record. The Wireshark project tracks the underlying fix in GitLab work item 21525.

Attack Vector

An attacker crafts a malformed capture file (for example, a .pcap or .pcapng) or injects a specially formed frame onto a network segment being captured. The victim opens the file in Wireshark or runs tshark against it, and the Frame metadissector aborts. The vector is local and requires user interaction, so realistic delivery scenarios include phishing analysts with attached capture files or seeding shared incident response repositories with poisoned samples. No credentials are needed to weaponize the file itself.

Refer to Wireshark Security Advisory wnpa-sec-2026-102 for the vendor's technical description.

Detection Methods for CVE-2026-96422

Indicators of Compromise

Unexpected termination of wireshark, tshark, or dumpcap processes shortly after opening a capture file
Application error logs or crash dumps referencing the Frame dissector or an assertion failure
Repeated crashes when replaying a specific .pcap or .pcapng sample across multiple analyst workstations

Detection Strategies

Inventory installed Wireshark versions across analyst endpoints and flag hosts running 4.6.0–4.6.8 or 4.4.0–4.4.18
Alert on process crash events for Wireshark binaries in EDR telemetry and correlate with recent file-open activity
Scan shared capture repositories and email attachments for .pcap/.pcapng files that reliably crash a sandboxed Wireshark instance

Monitoring Recommendations

Forward Wireshark and tshark crash telemetry into the SIEM for trend analysis
Monitor package management logs for Wireshark upgrades to confirm patch rollout
Track ingestion pipelines that automatically dissect capture files and alert on repeated dissector aborts

How to Mitigate CVE-2026-96422

Immediate Actions Required

Upgrade Wireshark to a fixed release published in Wireshark Security Advisory wnpa-sec-2026-102
Restrict opening of untrusted capture files to isolated analysis virtual machines
Disable automated dissection of externally sourced .pcap/.pcapng files until patched

Patch Information

The Wireshark Foundation addresses CVE-2026-96422 in updated 4.6.x and 4.4.x releases referenced in advisory wnpa-sec-2026-102. Track the upstream fix in GitLab work item 21525 and validate the deployed version by running wireshark --version or tshark --version after upgrade.

Workarounds

Avoid opening capture files received from untrusted or unverified sources
Run Wireshark inside a non-privileged, sandboxed account so a crash cannot disrupt other tools
Use dumpcap for capture-only workflows and defer dissection to a patched host

bash

# Verify the installed Wireshark version on Linux
wireshark --version | head -n 1
tshark --version | head -n 1

# Example upgrade paths
# Debian / Ubuntu
sudo apt update && sudo apt install --only-upgrade wireshark tshark

# Fedora / RHEL
sudo dnf upgrade wireshark wireshark-cli