CVE-2026-9759: Wireshark ROHC Dissector DoS Vulnerability

CVE-2026-9759 Overview

CVE-2026-9759 is a denial of service vulnerability in the Robust Header Compression (ROHC) protocol dissector in Wireshark. The flaw affects Wireshark versions 4.6.0 through 4.6.5 and 4.4.0 through 4.4.15. An attacker can trigger a crash by causing a user to open a crafted capture file or by injecting malformed packets onto a network that Wireshark is actively capturing. The issue is tracked under [CWE-476] (NULL Pointer Dereference) and documented in Wireshark Security Advisory wnpa-sec-2026-51.

Critical Impact

Successful exploitation causes Wireshark to crash, disrupting packet analysis workflows and incident response activities that depend on the tool.

Affected Products

• Wireshark 4.6.0 through 4.6.5
• Wireshark 4.4.0 through 4.4.15
• ROHC protocol dissector component

Discovery Timeline

• 2026-05-27 - CVE-2026-9759 published to NVD
• 2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-9759

Vulnerability Analysis

The vulnerability resides in the ROHC protocol dissector within Wireshark. ROHC compresses IP, UDP, RTP, and TCP headers to reduce overhead on bandwidth-constrained links. The dissector parses ROHC-encoded packets to present them in human-readable form. A malformed ROHC packet triggers a NULL pointer dereference [CWE-476], terminating the Wireshark process.

The attack vector is local and requires user interaction. An analyst typically triggers the condition by opening a crafted .pcap or .pcapng capture file. The same crash can occur during live capture when malformed ROHC traffic traverses a monitored interface. Confidentiality and integrity are not affected, but availability of the analysis tool is lost.

For incident responders and network operations teams, the impact extends beyond a single crash. Repeated exposure to malicious capture files distributed through phishing or shared sample repositories can disrupt forensic investigations. Refer to GitLab Work Item #21243 for the upstream tracking record.

Root Cause

The root cause is a missing pointer validation in the ROHC dissector code path. When the dissector encounters unexpected field values or truncated structures, it dereferences a pointer that was never assigned a valid address. The runtime fault terminates the process immediately.

Attack Vector

An attacker crafts a packet capture file or live network frames containing malformed ROHC structures. Delivery occurs through email attachments, malware analysis sample sharing, or direct transmission on a monitored link. Opening the file or capturing the frame triggers the crash without further interaction.

No verified exploit code has been published. The vulnerability mechanism is described in the official Wireshark advisory linked above.

Detection Methods for CVE-2026-9759

Indicators of Compromise

• Unexpected termination of wireshark or tshark processes during capture file analysis
• Operating system crash logs referencing the Wireshark binary and a segmentation fault or access violation
• Capture files originating from untrusted sources that contain ROHC protocol frames

Detection Strategies

• Monitor endpoint telemetry for abnormal exit codes from Wireshark and tshark processes on analyst workstations
• Inspect shared capture file repositories for .pcap and .pcapng files containing ROHC traffic from untrusted contributors
• Correlate analyst workstation crashes with recent file downloads or email attachments

Monitoring Recommendations

• Track installed Wireshark versions across analyst endpoints and flag systems running 4.6.0–4.6.5 or 4.4.0–4.4.15
• Audit access patterns to network capture sample repositories used by SOC and DFIR teams
• Log process crash events centrally to identify repeated targeting of Wireshark users

How to Mitigate CVE-2026-9759

Immediate Actions Required

• Upgrade Wireshark to a version released after 4.6.5 or 4.4.15 that contains the fix for wnpa-sec-2026-51
• Restrict analysis of untrusted capture files to isolated, non-production workstations or virtual machines
• Communicate the issue to SOC and DFIR teams that routinely process third-party packet captures

Patch Information

The Wireshark project addressed the ROHC dissector crash in updates referenced by Wireshark Security Advisory wnpa-sec-2026-51. Apply the latest stable release from the 4.6 or 4.4 branch on all systems where Wireshark is installed.

Workarounds

• Disable the ROHC dissector through Analyze → Enabled Protocols in the Wireshark UI when patching is not immediately possible
• Use tshark with --disable-protocol rohc to prevent the dissector from executing on capture files
• Avoid opening capture files received from untrusted parties until the upgrade is applied

# Disable the ROHC dissector at the command line
tshark --disable-protocol rohc -r suspicious_capture.pcapng